Stored Cross-Site Scripting Vulnerability in OpenCart by OpenCart
CVE-2025-45893

6.1MEDIUM

Key Information:

Vendor

OpenCart

Status
OpenCart
Vendor
CVE Published:
25 July 2025

What is CVE-2025-45893?

OpenCart version 4.1.0.4 contains a vulnerability that allows stored cross-site scripting (XSS) through improperly sanitized SVG file uploads in blog posts. Attackers can exploit this flaw by uploading a malicious SVG file that includes embedded JavaScript, potentially compromising the integrity of the website and affecting users who access the blog. Website administrators should ensure that all uploaded files are thoroughly checked and sanitized to prevent such attacks.

References

https://www.opencart.com
https://packetstorm.news/files/id/202886

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.