Executive brief
bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)
Affected products
- Packagist bagisto/bagisto
Junglewise Threat Intelligence
CVE-2025-62418: bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)
CVE-2025-62418 · Severity: low · CVSS 3.1 · Published 2025-10-16
Technologies: bagisto/bagisto (Packagist). Vendors: Packagist.
Related threats
- Bagisto affected by Cross-site Scripting
- Bagisto affected by Server-Side Request Forgery
- Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
- Bagisto has IDOR in Customer Order Reorder Functionality
- Bagisto has Normal & Blind SSTI from low-privilege user when ordering product