UpHeron
All vulnerabilities

Servers and applications

CVE-2025-45893

OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because SVG files uploaded through the media manager are not properly sanitized. Attackers can craft a malicious SVG file containing embedded JavaScript

Severity
Medium 6.1
Published
25 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
OpenCartServers and applications · cpe:a:opencart:opencart
  • Every version up to 4.1.0.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-45893
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-45893