CVE-2025-57407
Last modified
CVE-2025-57407 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gp247 | Gp247 | < 1.1.24 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-57407?
How severe is CVE-2025-57407?
How do I fix CVE-2025-57407?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-5739A vulnerability classified as critical has been found in TOT…8.8
- CVE-2025-57392BenimPOS Masaustu 3.0.x is affected by insecure file permiss…7.8
- CVE-2025-57393A stored cross-site scripting (XSS) in Kissflow Work Platfor…8.8
- CVE-2025-57396Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vu…6.5
- CVE-2025-5740CWE-22: Improper Limitation of a Pathname to a Restricted Di…8.6
- CVE-2025-57403Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. Whe…7.5
- CVE-2025-5741CWE-22: Improper Limitation of a Pathname to a Restricted Di…6.9
- CVE-2025-5742CWE-79: Improper Neutralization of Input During Web Page Gen…5.4
- CVE-2025-57423A SQL injection vulnerability was discovered in the /article…6.5
- CVE-2025-57424A stored cross-site scripting (XSS) vulnerability exists in …7.3
- CVE-2025-57425A Stored Cross-Site Scripting (XSS) vulnerability in SourceC…6.1
- CVE-2025-57428Default credentials in Each Italy Wireless Mini Router WIREL…6.5
Are you affected by CVE-2025-57407?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST