Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 22:25:23 +0000 EUVD-2026-264835 https://cve.radiocsirt.org/vuln/euvd-2026-264835 EUVD-2026-264835 https://cve.radiocsirt.org/vuln/euvd-2026-264835 fkie_cve-2026-21449 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21449 <p>Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.</p> <p>Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via first name and last name from a low-privilege user. Version 2.3.10 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21449 GHSA-mqhg-v22x-pqj8 — Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users https://cve.radiocsirt.org/vuln/ghsa-mqhg-v22x-pqj8 <p><strong>Affected:</strong> Packagist: bagisto/bagisto</p> <p>### Summary SSTI is possible via first name and last name parameters provided by lowest-privileged users. ### Details 1. Go to `http://127.0.0.1:8000/` and login or signup 2. Go to `http://127.0.0.1:8000/customer/account/profile` 3. Now edit the first name and last name to {{7*7}} 4. Notice it appears as 49</p> <p>### POC - Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912</p> <p>### Impact This can lead to RCE, command injection.</p> <p><strong>Affected:</strong> Packagist: bagisto/bagisto</p> <p>### Summary SSTI is possible via first name and last name parameters provided by lowest-privileged users. ### Details 1. Go to `http://127.0.0.1:8000/` and login or signup 2. Go to `http://127.0.0.1:8000/customer/account/profile` 3. Now edit the first name and last name to {{7*7}} 4. Notice it appears as 49</p> <p>### POC - Video attached with the report: https://github.com/user-attachments/assets/f93932b5-2a57-4f34-897e-4151a5168912</p> <p>### Impact This can lead to RCE, command injection.</p> https://cve.radiocsirt.org/vuln/ghsa-mqhg-v22x-pqj8