Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Bagisto admin create-customer form can run malicious code

CVE-2025-62414 · published 1 year ago
Summary

The admin page for adding new customers in Bagisto versions before 2.3.8 allows a user with access to that form to insert harmful JavaScript. That code can run later in an administrator’s browser or when the customer data is viewed, potentially stealing sessions or performing actions as the admin. Upgrade to version 2.3.8 or later to remove the risk.

What to do
  • Update bagisto bagisto to version 2.3.8.
Affected software
Ecosystem VendorProductAffected versions
composer bagisto bagisto <= 2.3.7
Fix: upgrade to 2.3.8
– webkul bagisto 2.3.7
cpe:2.3:a:webkul:bagisto:2.3.7:*:*:*:*:*:*:*
Original advisory text
bagisto - Cross Site Scripting (XSS) in Create New Customer
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin’s browser or another user viewing the customer data, enabling session theft or admin-level actions. This vulnerability is fixed in 2.3.8.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
CWE-80Basic XSS
CWE-87Improper Neutralization of Alternate XSS Syntax
Timeline
Published16 Oct 2025
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-r9xj-mvqf-jm7w · GHSA
CVE-2025-62414 · NVD
CVE-2025-62414 · OSV
Track software like this
Free during beta