OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://packetstorm.news/files/id/202886 | Third Party Advisory |
| https://www.opencart.com | Product |
Configurations
History
07 Aug 2025, 01:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:* | |
| First Time |
Opencart opencart
Opencart |
|
| References | () https://packetstorm.news/files/id/202886 - Third Party Advisory | |
| References | () https://www.opencart.com - Product |
25 Jul 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-07-25 17:15
Updated : 2025-08-07 01:31
NVD link : CVE-2025-45893
Mitre link : CVE-2025-45893
JSON object : View
Products Affected
opencart
- opencart
CWE
No CWE.