CVE-2025-62414

Katalog CVE

CVSS 4.8 · Medium EPSS 0,28%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) pada webkul bagisto. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later execute in the context of an admin’s browser or another user viewing the customer data, enabling session theft or admin-level actions. This vulnerability is fixed in 2.3.8.

Rincian

Terbit di NVD

16 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-87: Improper Neutralization of Alternate XSS Syntax
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bagisto/bagisto/security/advisories/GHSA-r9xj-mvqf-jm7w exploit · advisory vendor