https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T02:15:45.618390+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-21448 CVE-2026-21448 — Bagisto has Normal & Blind SSTI from low-privilege user when ordering product 2026-10-16T02:15:45.634538+00:00

Affected: bagisto

Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.