CVE-2025-60880

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file…

High · published October 10, 2025

CVSS v3.1
8.3
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:L/PR:H/S:C/UI:R
CVSS v4.0
Not supplied
EPSS
0.00410 · 34.1th percentile
Published
2025-10-10T00:00Z
EPSS history
Timeline
  • 10 OCT 00:00Z
    An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file…
    cvelistv5