Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-62418

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

Published

2025-10-16T19:15:34.803

Last Modified

2025-10-22T16:55:04.337

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.9 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-80
    CWE-87
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application webkul bagisto 2.3.7 Yes
References