PT-2025-30910 · Opencart · Opencart

Published 2025-07-25 · Updated 2025-08-08 · CVE-2025-45892

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenCart version 4.1.0.4

Description OpenCart version 4.1.0.4 is susceptible to a Stored Cross-Site Scripting (XSS) attack through the blog editor. The issue occurs because input within the blog editor is not adequately sanitized or escaped before rendering, enabling attackers to inject malicious JavaScript code.

Recommendations Ensure proper sanitization and escaping of all user-supplied input within the blog editor.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-OPENCART-2025-45892

CVE-2025-45892

Affected Products

Opencart

References · 8

• https://osv.dev/vulnerability/CVE-2025-45892 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-opencart-2025-45892 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-45892 · Security Note
• https://t.me/cveNotify/131189 · Telegram Post
• https://opencart.com · Note
• https://twitter.com/CVEnew/status/1948794754164294004 · Twitter Post
• https://packetstorm.news/files/id/202886 · Note
• https://twitter.com/VulmonFeeds/status/1948887423951286277 · Twitter Post