CVE-2025-62415bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)

Descripción

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• https://github.com/bagisto/bagisto/security/advisories/GHSA-67px-r26w-598x ExploitVendor Advisory