CVE-2025-60880
CVE-2025-60880
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
CVSS 8.3 · High · EPSS 0.4% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
bagisto/bagisto Packagist
- Versions
- 2.3.6
- v2.3.6
- Affected ranges
- ECOSYSTEM: ≥ 2.3.6, < 2.3.7
Update to 2.3.7