CVE-2019-10015: Baigo SSO

High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days.

baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BG_SITE_NAME field in the opt_base.inc.php file.

Affected products

• Baigo Baigo SSO: version 3.0.1 only

Published 2019-03-24. Last modified 2026-06-17.