Security Advisory

CVE-2025-62415

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-10-16 18:36:51

Last updated 2025-10-17 14:30:51

Assigner GitHub_M

CVSS score 6.9

State PUBLISHED

Description

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

← Browse all CVEs View on cve.org ↗