CVE-2025-60880

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SV...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Références

advisory github.com
advisory nvd.nist.gov
package github.com
web gist.github.com