https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T21:46:27.536546+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-121733 CVE-2026-121733 — Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload 2026-11-05T21:46:27.537665+00:00

Affected: Webkul Bagisto

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under /storage/rma-conversation/, executing script in the shop's origin when an administrator opens it.