CVE-2025-57407
GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
- Record
CVE-2025-57407- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-30918
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
- Record
EUVD-2025-30918- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-46v4-5mc8-q2cf
GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
- Record
GHSA-46v4-5mc8-q2cf- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
- Record
CVE-2025-57407- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-06
OSV
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
- Record
CVE-2025-57407- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-07
OSVGHSA-46v4-5mc8-q2cf
GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
- Record
GHSA-46v4-5mc8-q2cf- CVSS 4.0
- 1.3 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
s-cart/corePackagist |
through 9.0.5 | None known |
gp247/corePackagist |
before 1.1.24 | 1.1.24 |
s-cart/corePackagist |
through 9.0.5, plus listed versions 4.0.04.0.0-beta4.0.14.0.1.14.0.1.2 Show 45 moreShow less4.0.1.34.0.1.44.0.1.54.1.04.1.0.14.1.0.24.1.0.34.1.0.44.1.0.54.1.14.2.04.2.14.2.1.14.2.1.24.2.1.34.2.1.44.2.1.54.2.2.04.2.2.14.2.2.24.2.3.04.3.04.3.0.14.3.14.3.1.14.3.1.24.3.2.04.4.0-beta4.4.0.04.4.0.14.4.0.24.4.0.34.4.0.44.4.0.54.4.1.04.4.1.14.4.2.04.5.04.5.14.5.25.0.05.0.0-beta5.0.15.0.25.0.2.1 |
None known |
gp247/corePackagist |
before 1.1.24, plus listed versions 1.01.0-beta1.0.11.0.21.0.3 Show 30 moreShow less1.0.41.0.51.0.61.0.71.0.81.0.91.11.1.11.1.101.1.111.1.121.1.131.1.141.1.151.1.161.1.171.1.181.1.191.1.21.1.201.1.211.1.221.1.231.1.31.1.41.1.51.1.61.1.71.1.81.1.9 |
1.1.24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-57407 is a medium vulnerability (CVSS 5.4) in Gp247, published September 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in gp247/core 1.1.24.
References
github.com/s-cart/core/blob/7c9aa42761be5fd0131c61dbe2b5323beb96d5dd/src/Admin/Controllers/AdminLogController.php
nvd.nist.gov/vuln/detail/CVE-2025-57407
Left out here: 330 versions. The JSON record has them.