CVE-2025-57407

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-23 · updated 2026-06-17
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.

Affected products

Gp247: before 1.1.24 — fixed in 1.1.24

How to fix

Upgrade to a fixed version: Gp247 1.1.24. Check the vendor advisory for mitigations.

References

https://github.com/gp247net/core/releases/tag/1.1.24
https://github.com/s-cart/core/blob/7c9aa42761be5fd0131c61dbe2b5323beb96d5dd/src/Admin/Controllers/AdminLogController.php

Get alerted when CVE-2025-57407 or the next vulnerability affects your stack