PT-2025-42533 · Bagisto · Bagisto

Published 2025-10-16 · Updated 2025-10-17 · CVE-2025-62414

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8

Description Bagisto version 2.3.7 contains a Cross-Site Scripting (XSS) issue within the “Create New Customer” feature in the admin panel. An attacker who can access the admin create-customer form can inject malicious JavaScript payloads into input fields. These payloads can execute in the context of an admin’s browser or another user viewing the customer data, potentially enabling session theft or unauthorized admin-level actions. The issue arises because input fields are not properly sanitized or escaped when rendering customer data in the admin UI, leading to stored XSS where the malicious script persists in the database and executes when the data is viewed. The vulnerable input fields include first name and last name.

Recommendations Upgrade to Bagisto version 2.3.8 or later to resolve this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-87

CWE-79

Related Identifiers

CVE-2025-62414

GHSA-R9XJ-MVQF-JM7W

Affected Products

Bagisto

References · 10

• 🔥 https://github.com/bagisto/bagisto/security/advisories/GHSA-r9xj-mvqf-jm7w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62414.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62414 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62414 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r9xj-mvqf-jm7w · Vendor Advisory
• https://github.com/bagisto/bagisto · Note
• https://twitter.com/CVEnew/status/1978926555783959017 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o91x4z/resumen_diario_de_vulnerabilidades_17102025 · Reddit Post
• https://twitter.com/VulmonFeeds/status/1978951553965871306 · Twitter Post
• https://t.me/CVEtracker/35146 · Telegram Post