# CVE-2026-21451 - Bagisto < 2.3.10 CMS page editor stores page HTML without effective script
# filtering (the <script> filter is bypassable by manipulating the raw POST), yielding stored
# XSS executed when the page is viewed or edited by an administrator. Detect a CMS page save
# (/admin/cms edit/create) whose html_content field carries an active script payload.
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-21451 Bagisto - Stored XSS via CMS Page html_content"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/admin/cms"; nocase; fast_pattern; http.request_body; content:"html_content"; nocase; pcre:"/html_content(?:%5d|\x5d|%22|\x22)?[^&]*(?:(?:<|%3c)\s*(?:script|svg|iframe|img|object|embed)|on(?:load|error|click|mouseover|focus|animationstart)\s*(?:=|%3d))/i"; classtype:web-application-attack; reference:cve,CVE-2026-21451; reference:url,https://www.exploit.observer/?keyword=CVE-2026-21451&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=bagisto&match=exact; sid:1101207; rev:1;)