Executive brief
OpenMage vulnerable to XSS in Admin Notifications
Affected products
- Packagist openmage/magento-lts
Junglewise Threat Intelligence
CVE-2025-64174: OpenMage vulnerable to XSS in Admin Notifications
CVE-2025-64174 · Severity: medium · CVSS 4 · Published 2025-11-03
Technologies: openmage/magento-lts (Packagist). Vendors: Packagist.
Related threats
- OpenMage Magento LTS reflected XSS in Dataflow Profiles
- OpenMage Magento LTS open redirect in stockAction controller
- OpenMage Magento LTS predictable API session ID generation
- OpenMage LTS: Customer File Upload Extension Blocklist Bypass → Remote Code Execution
- OpenMage LTS: Cross-user wishlist import leads to private option & file disclosure