https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 03:08:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-264836 EUVD-2026-264836 https://cve.radiocsirt.org/vuln/euvd-2026-264836 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21448 <p>Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.</p> <p>Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a normal customer orders any product, in the `add address` step they can inject a value to run in admin view. The issue can lead to remote code execution. Version 2.3.10 contains a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21448 https://cve.radiocsirt.org/vuln/ghsa-5j4h-4f72-qpm6 <p><strong>Affected:</strong> Packagist: bagisto/bagisto</p> <p>### Summary SSTI when normal customer orders any product in add address step can inject value run in admin view. ### Details `As normal user` 1. Go to `http://127.0.0.1:8000/` 2. Add order to cart and continue to checkout 3. In step of add address inject this value {{7*7}} in any input</p> <p>`As admin` 1. Go to `http://127.0.0.1:8000/admin/sales/orders` 2. And notice the vlaue appear in admin view 49</p> <p>`As normal user` 3. Go to add address normally `http://127.0.0.1:8000/customer/account/addresses/create` and inject {{7*7}} on it and will notice it appear 49 &lt;img width=&#34;1868&#34; height=&#34;868&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25&#34; /&gt;</p> <p>### PoC - Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d</p> <p>### Impact - Can lead to RCE</p> <p><strong>Affected:</strong> Packagist: bagisto/bagisto</p> <p>### Summary SSTI when normal customer orders any product in add address step can inject value run in admin view. ### Details `As normal user` 1. Go to `http://127.0.0.1:8000/` 2. Add order to cart and continue to checkout 3. In step of add address inject this value {{7*7}} in any input</p> <p>`As admin` 1. Go to `http://127.0.0.1:8000/admin/sales/orders` 2. And notice the vlaue appear in admin view 49</p> <p>`As normal user` 3. Go to add address normally `http://127.0.0.1:8000/customer/account/addresses/create` and inject {{7*7}} on it and will notice it appear 49 &lt;img width=&#34;1868&#34; height=&#34;868&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/279627e9-6361-4d39-a500-0fc20e163d25&#34; /&gt;</p> <p>### PoC - Video attached with the report: https://github.com/user-attachments/assets/a814b30c-a3e2-4a40-8644-336e21e60d0d</p> <p>### Impact - Can lead to RCE</p> https://cve.radiocsirt.org/vuln/ghsa-5j4h-4f72-qpm6