CVE-2026-6745

A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and explains: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."

• CWE-79
• CWE-94

• https://drive.google.com/drive/folders/10p6SYcSVyfaaTg_dgItzMJvqixcmKnHR?usp=sharing
• https://vuldb.com/submit/794681
• https://vuldb.com/vuln/358436
• https://vuldb.com/vuln/358436/cti

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67435linuxfabrik-lib provides Python modules for database access,…6
• CVE-2026-67436Linuxfabrik monitoring-plugins provides Python monitoring pl…8.3
• CVE-2026-67437OliveTin gives access to predefined shell commands from a we…7.5
• CVE-2026-67438OliveTin gives access to predefined shell commands from a we…6.6
• CVE-2026-67439OliveTin gives safe and simple access to predefined shell co…4.3
• CVE-2026-6744A vulnerability was found in Bagisto up to 2.3.15. Affected …6.3
• CVE-2026-6746Use-after-free in the DOM: Core & HTML component. This vulne…7.5
• CVE-2026-67465A pre-authentication attacker could leverage unbounded symbo…7.5
• CVE-2026-6747Use-after-free in the WebRTC component. This vulnerability w…7.5
• CVE-2026-6748Uninitialized memory in the Audio/Video: Web Codecs componen…9.8
• CVE-2026-6749Information disclosure due to uninitialized memory in the Gr…7.5
• CVE-2026-6750Privilege escalation in the Graphics: WebRender component. T…8.8