CVE-2025-10909
CVE-2025-10909 · Mangati NovoSGA SVG File admin cross site scripting
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
CVSS 4.8 · Medium · EPSS 0.3%
- Published
- Updated
Stack: php
Affected products and versions
novosga
- Versions
- 2.2.0: Affected
- 2.2.1: Affected
- 2.2.2: Affected
- 2.2.3: Affected
- 2.2.4: Affected
- 2.2.5: Affected
- 2.2.6: Affected
- 2.2.7: Affected
- 2.2.8: Affected
- 2.2.9: Affected
No fix published
novosga/novosga Packagist
- Versions
- 2.0.0-RC1
- 2.2.2
- 2.2.3
- v1.0.0
- v1.0.1
- v1.0.2
- v1.0.3
- v1.0.4
- v1.1.0
- v1.1.1
- v1.1.2
- v1.1.3
- v1.1.4
- v1.2.0
- v1.2.1
- v1.3.0
- v1.3.1
- v1.3.2
- v1.3.3
- v1.4.0
- v1.4.1
- v1.5.0
- v1.5.1
- v1.5.2
- v2.0.0
- v2.0.0-BETA1
- v2.0.0-BETA2
- v2.0.0-BETA3
- v2.0.0-BETA4
- v2.0.0-BETA5
- v2.0.0-BETA6
- v2.0.0-RC2
- v2.0.0-RC3
- v2.0.1
- v2.0.10
- v2.0.11
- v2.0.2
- v2.0.3
- v2.0.4
- v2.0.5
- v2.0.6
- v2.0.7
- v2.0.8
- v2.0.9
- v2.1.0
- v2.1.1
- v2.1.2
- v2.1.3
- v2.1.4
- v2.1.5
- v2.1.6
- v2.1.7
- v2.1.8
- v2.1.9
- v2.2.0
- v2.2.0-beta.1
- v2.2.0-beta.2
- v2.2.1
- v2.2.4
- v2.2.5
- v2.2.6
- v2.2.7
- v2.2.8
- v2.2.9
- Affected ranges
- ECOSYSTEM: ≤ 2.2.9
No fix published