Shenal01/CVE-2025-60880

Shenal01/CVE-2025-60880

GitHubGitHub
GitHubgithub.com
Releases0
CVE-2025-60880 - Stored Cross-Site Scripting (XSS) in Bagisto Admin Panel
Log in to subscribe

CVE History

CVEPublishedCVSS v3CVSS v2
CVE-2025-60880↗
8.3 HIGH—

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.