CVE-2025-60880: XSS
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60880?
CVE-2025-60880 is classified as a medium severity vulnerability due to its potential for authenticated users to execute arbitrary JavaScript.
How do I fix CVE-2025-60880?
To fix CVE-2025-60880, ensure that SVG file uploads are properly validated to prevent the execution of malicious JavaScript.
Who is affected by CVE-2025-60880?
CVE-2025-60880 affects the Bagisto 2.3.6 admin panel during the product creation process.
What type of vulnerability is CVE-2025-60880?
CVE-2025-60880 is an authenticated stored cross-site scripting (XSS) vulnerability.
Can CVE-2025-60880 be exploited remotely?
CVE-2025-60880 cannot be exploited remotely as it requires authenticated admin access to the Bagisto admin panel.