Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users

Mô tả

Tham khảo

• bagisto/bagisto security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2026-21449 · ADVISORY
• bagisto/bagisto commit 4144931 · WEB
• bagisto/bagisto · PACKAGE
• bagisto/bagisto release v2.3.10 · WEB

Lỗ hổng khác của bagisto/bagisto

• CVE-2026-6745THẤP 3.5A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom S…
• CVE-2026-6744TRUNG BÌNH 6.3A vulnerability was found in Bagisto up to 2.3.15. Affected is the function copy of the component Downloadable Link Handler. The manipulatio…
• CVE-2026-21451CAO 8.4Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2…
• CVE-2026-21450NGHIÊM TRỌNG 9.8Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection via type par…
• CVE-2026-21448NGHIÊM TRỌNG 9.8Bagisto is an open source laravel eCommerce platform. Versions prior to 2.3.10 are vulnerable to server-side template injection. When a norm…