CVE-2025-60880

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SV...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

参照URL

advisory github.com
advisory nvd.nist.gov
package github.com
web gist.github.com