CVE-2025-62415
Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
- EPSS probability
- 0.26%
- CWE
- CWE-80, CWE-87
- Published
- 2025-10-16
- Last modified
- 2026-03-13
Affected products
- bagisto bagisto
Weakness type
Related vulnerabilities
- CVE-2026-52774 — Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki
- CVE-2026-52773 — Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki
- CVE-2026-32773 — Apache Spark: XSS Vulnerability in Spark Web 3.5.4
- CVE-2026-82838 — Default webserver configuration with incorrect CSP
- CVE-2026-55696 — PrivateBin: Stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
- CVE-2026-5218 — HTML Injection in Softtr's E-Commerce Pack
- CVE-2026-5389 — justhtml before 1.13.0 XSS via code fence breakout
- CVE-2026-35163 — OctoPrint: XSS in Suppressed Command Notifications