CVE-2025-57407

5.4 mediumEPSS 0.2%

Medium (5.4) in gp247 gp247. EPSS 0.2% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-09-23
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gp247:gp247

References

https://github.com/gp247net/core/releases/tag/1.1.24
https://github.com/s-cart/core/blob/7c9aa42761be5fd0131c61dbe2b5323beb96d5dd/src/Admin/Controllers/AdminLogController.php

Check your stack JSON