{"id":"CVE-2025-45893","aliases":["BIT-opencart-2025-45893","EUVD-2025-22729","GHSA-h243-vvj5-46wx"],"status":"published","title":"OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file...","description":"OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0028,"percentile":0.20648,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-07-25T00:00:00Z","modified":"2026-10-28T02:31:11Z","affected":[{"source":"osv","ecosystem":"Bitnami","package":"opencart","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.1.0-4"}]}]}],"products":[{"vendor":"opencart","product":"opencart"}],"references":[{"url":"https://www.opencart.com","tags":["Product","web"]},{"url":"https://packetstorm.news/files/id/202886","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-45893","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-h243-vvj5-46wx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/45xxx/CVE-2025-45893.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-45893","description":"OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript","status":"published","published":"2025-07-25T00:00:00Z","modified":"2025-07-25T20:33:12.576Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:36.385228Z"}],"euvd":[{"id":"EUVD-2025-22729","description":"OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript","status":"published","published":"2025-07-25T00:00:00Z","modified":"2025-07-25T20:33:12Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:03.907132Z"}],"ghsa":[{"id":"GHSA-h243-vvj5-46wx","title":"OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file...","description":"OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript","status":"published","published":"2025-07-25T18:30:41Z","modified":"2025-07-25T21:34:52Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:03:07.428711Z"}],"nvd":[{"id":"CVE-2025-45893","description":"OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript","status":"published","published":"2025-07-25T17:15:32.52Z","modified":"2026-06-17T09:25:49.53Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:21.132141Z"}],"osv":[{"id":"CVE-2025-45893","description":"OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript","status":"published","published":"2025-07-25T00:00:00Z","modified":"2026-10-28T02:31:11.213644731Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:49.707645Z"},{"id":"BIT-opencart-2025-45893","description":"OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript","status":"published","published":"2025-08-07T10:49:57.676Z","modified":"2025-08-07T11:27:20.57818Z","updated_at":"2026-11-02T15:28:34.343258Z"}]}}