CVE-2025-60880 Bagisto is vulnerable to XSS through Admin Panel's product creation path
HighCVSS 8.3
EPSS 0.41%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bagisto/bagisto(Packagist) | >= 2.3.6, < 2.3.7 | 2.3.7 |
| bagisto/bagisto(Packagist) | = 2.3.6 | No fix listed |
| bagisto/bagisto(Packagist) | = v2.3.6 | No fix listed |
| webkul Bagisto | = 2.3.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- gist.github.com exploit third-party-advisory
- github.com exploit third-party-advisory
- github.com product
- github.com
- github.com