GitHub Advisoryadvisory · Packagist

GHSA-46v4-5mc8-q2cf GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability

LOW Published 2025-09-23 Modified 2025-09-23 Official page ↗
Aliases
CVE-2025-57407
Ecosystem
Packagist
Packages
s-cart/core, gp247/core
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U
Weaknesses
CWE-79
Reviewed
2025-09-23

Affected packages

• Packagist s-cart/core: <= 9.0.5 (no fix yet) • Packagist gp247/core: < 1.1.24 → fixed in 1.1.24

Description

A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.

Related

Alias · CVE (1)

  • CVE-2025-57407 A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References