CVE-2025-60880

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-60880
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60880.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-60880
Aliases
Published
2025-10-10T00:00:00Z
Modified
2026-07-15T01:49:20.952322293Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AC:L/AV:N/A:H/C:H/I:L/PR:H/S:C/UI:R CVSS Calculator
Summary
[none]
Details

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/60xxx/CVE-2025-60880.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/bagisto/bagisto

Affected ranges

Type
GIT
Repo
https://github.com/bagisto/bagisto
Events
Introduced
c5dd6cea74852a56967af0dba7ef4860fabe7710
Last affected
c5dd6cea74852a56967af0dba7ef4860fabe7710
Database specific 
{
    "cpe": "cpe:2.3:a:webkul:bagisto:2.3.6:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.3.6"
        },
        {
            "last_affected": "2.3.6"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*
2.3.6
v2.*
v2.3.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-60880.json"