CVE-2025-62415
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)
Résumé
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov