https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T01:12:21.903120+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-264833 EUVD-2026-264833 2026-10-15T01:12:21.905288+00:00 EUVD-2026-264833 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21450 fkie_cve-2026-21450 2026-10-15T01:12:21.905316+00:00

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type parameter, which can lead to remote code execution or another exploitation. Version 2.3.10 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-9hvg-qw5q-wqwp GHSA-9hvg-qw5q-wqwp — Bagisto SSTI vulnerability in type parameter can lead to RCE 2026-10-15T01:12:21.905345+00:00

Affected: Packagist: bagisto/bagisto

### Summary SSTI is possible in Bagisto via type parameter can lead to RCE and other exploitations.

### Details 1. Go to `http://127.0.0.1:8000/admin/reporting/products/view?type={{7*7}}`

<img width="1251" height="282" alt="image" src="https://github.com/user-attachments/assets/652e96f4-631e-4322-8561-63f4d897a480" />

### Impact Can lead to RCE, command injection.