PT-2025-41590 · Bagisto · Bagisto

Shenal01 · Publicado 2025-10-10 · Atualizado 2026-01-08 · CVE-2025-60880

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions Bagisto version 2.3.6

Description An authenticated stored Cross-Site Scripting (XSS) issue exists in the admin panel's product creation functionality. An attacker can upload a crafted SVG file containing malicious JavaScript code. This allows execution of arbitrary JavaScript in the browser of an authenticated admin user, potentially leading to session hijacking or data theft. The vulnerability is triggered when the malicious SVG file is rendered. The affected path is the product creation process within the admin panel.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-60880

GHSA-29MF-W486-V3VC

Produtos afetados

Bagisto

Referências · 14

• 🔥 https://gist.github.com/daman-preet-singh/cd431f4c30a585bb87d3c69e4a8eec98 · Exploit
• 🔥 https://github.com/Shenal01/CVE-2025-60880 · Exploit
• https://github.com/bagisto/bagisto · Nota
• https://github.com/bagisto/bagisto/commit/9ec40c99c34a83f311ffbb7c1039a59ff9d655cc · Nota
• https://github.com/darylldoyle/svg-sanitizer/releases · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-60880 · Nota de Segurança
• https://twitter.com/HackingTeam777/status/1977840286165586320 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1o6h2pg/resumen_diario_de_vulnerabilidades_14102025 · Publicação no Reddit
• https://t.me/cveNotify/148132 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-60880 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1976723481640198297 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1o5knot/resumen_diario_de_vulnerabilidades_13102025 · Publicação no Reddit
• https://osv.dev/vulnerability/GHSA-29mf-w486-v3vc · Aviso do Fabricante
• https://twitter.com/CveTodo/status/1976731557822882099 · Publicação no Twitter