EUVD-2026-42694
GHSA-p295-7jh5-9j54
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible web app; low-privilege customer account required for payload delivery; administrator must interact (UI:R); scope changes to admin browser (S:C); no availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.
AnalysisAI
Stored client-side template injection in Bagisto before v2.4.4 allows any attacker who can register a customer account to execute arbitrary JavaScript in an administrator's browser. The create.blade.php template renders customer name fields inside a Vue.js context without the v-pre directive, causing Vue.js to evaluate stored template expressions as live code when an administrator opens the Create Order page for the affected customer. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, though the stored nature of the payload and its execution in an admin session context make this a higher real-world priority than the CVSS 4.0 score of 5.1 alone suggests.
Technical ContextAI
Bagisto is an open-source Laravel/PHP e-commerce framework that uses Vue.js for frontend rendering. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). Specifically, the create.blade.php order-creation template in the Bagisto admin panel renders customer first and last name fields inside a Vue.js-managed DOM without the v-pre directive, which instructs Vue.js to skip template compilation for a subtree. Without v-pre, Vue.js treats stored double-curly-brace expressions (e.g., {{ malicious }}) or shorthand directive syntax as live template code and evaluates them at render time in the browser. This is a client-side template injection (CSTI) pattern, distinct from traditional reflected or stored XSS because server-side output encoding does not prevent it - the payload bypasses sanitization and is evaluated by the client-side framework itself. All Bagisto releases prior to v2.4.4 are affected.
RemediationAI
Upgrade Bagisto to version 2.4.4 or later; this is the only confirmed fix. The remediation adds the Vue.js v-pre directive to the customer name rendering in create.blade.php, preventing Vue.js from evaluating stored template expressions. The fix commit is at https://github.com/bagisto/bagisto/commit/49d0c3fc90dedf8782c45c5979df4f4595d6bb97 and the release is at https://github.com/bagisto/bagisto/releases/tag/v2.4.4. If an immediate upgrade is not possible, restrict administrator access to the Create Order page to trusted internal networks via firewall or reverse proxy ACLs - this prevents remote trigger of payload execution but does not remove stored payloads and reduces operational flexibility. As a complementary measure, audit existing customer name fields in the database for Vue.js template syntax (e.g., {{, }}, v-) to determine whether payloads have already been stored; if found, sanitize or delete the affected records. Neither workaround addresses the root cause.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today