Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')