PT-2025-39177 · S-Cart · S-Cart

Published 2025-09-23 · Updated 2025-09-24 · CVE-2025-57407

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions S-Cart versions prior to 10.0.4

Description A stored cross-site scripting (XSS) issue exists in the Admin Log Viewer component. A remote, authenticated attacker can inject arbitrary web script or HTML through a manipulated User-Agent header. When an administrator views the security log page, the injected script is executed in their browser, potentially leading to session hijacking or other malicious activities.

Recommendations Update S-Cart to version 10.0.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-57407

GHSA-46V4-5MC8-Q2CF

Affected Products

S-Cart

References · 8

• https://osv.dev/vulnerability/GHSA-46v4-5mc8-q2cf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57407 · Security Note
• https://osv.dev/vulnerability/CVE-2025-57407 · Vendor Advisory
• https://github.com/s-cart/core/blob/7c9aa42761be5fd0131c61dbe2b5323beb96d5dd/src/Admin/Controllers/AdminLogController.php · Note
• https://github.com/gp247net/core/commit/e9848706b41d835ca3d668cb1554650403e86da1 · Note
• https://github.com/gp247net/core/releases/tag/1.1.24 · Note
• https://twitter.com/CVEnew/status/1970621835936178325 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1970644260216033501 · Twitter Post