https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T22:25:37.781859+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-264835 EUVD-2026-264835 2026-10-15T22:25:37.783717+00:00 EUVD-2026-264835 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21449 fkie_cve-2026-21449 2026-10-15T22:25:37.783753+00:00

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-mqhg-v22x-pqj8 GHSA-mqhg-v22x-pqj8 — Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users 2026-10-15T22:25:37.783786+00:00

Affected: Packagist: bagisto/bagisto

### Summary SSTI is possible via first name and last name parameters provided by lowest-privileged users. ### Details 1. Go to `http://127.0.0.1:8000/` and login or signup 2. Go to `http://127.0.0.1:8000/customer/account/profile` 3. Now edit the first name and last name to {{7*7}} 4. Notice it appears as 49

### POC - Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912

### Impact This can lead to RCE, command injection.