{"action":"Upgrade bagisto/bagisto to 1.3.2 or later.","affected":[{"fixed":"1.3.2","introduced":"0"}],"component":"bagisto/bagisto","cve_ids":["CVE-2023-36236"],"ecosystem":"Packagist","epss":0.0061,"exploited":false,"fixed_versions":["1.3.2"],"ghsa_id":"GHSA-c962-g533-823f","id":"tcs_01M5KF0TM43HYPV6KW45CVRJFD","modified_at":"2025-06-17T19:59:42.973362Z","published_at":"2024-01-17T00:30:19Z","references":["https://osv.dev/vulnerability/GHSA-c962-g533-823f","https://nvd.nist.gov/vuln/detail/CVE-2023-36236","https://github.com/bagisto/bagisto/pull/4764/commits/7bbf0c4bb565fc2601f031f9bbcdfa06e24dbd45","https://github.com/bagisto/bagisto/commit/7bbf0c4bb565fc2601f031f9bbcdfa06e24dbd45","https://bagisto.com/en","https://github.com/Ek-Saini/security/blob/main/XSS_via_fileupload-bagisto"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-c962-g533-823f","url":"https://osv.dev/vulnerability/GHSA-c962-g533-823f"}],"summary":"Cross-site Scripting in Bagisto"}