CVE-2025-10909

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-10909
A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

2.4 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

3.3 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:L/Au:M/C:N/I:P/A:N

Exploitability : 6.4 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication MULTIPLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://karinagante.github.io/cve-2025-10909/
https://karinagante.github.io/cve-2025-10909/#proof-of-concept-poc
https://vuldb.com/?ctiid.325696
https://vuldb.com/?id.325696
https://vuldb.com/?submit.651379
Configurations

No configuration.

History

15 Apr 2026, 00:35

Type Values Removed Values Added
Summary
  • (es) Se ha descubierto una falla de seguridad en Mangati NovoSGA hasta la versión 2.2.9. El elemento afectado es una función desconocida del archivo /admin del componente SVG File Handler. Realizar la manipulación del argumento logoNavbar/logoLogin resulta en cross-site scripting. La explotación remota del ataque es posible. El exploit ha sido publicado y puede ser explotado.

20 Oct 2025, 05:15

Type Values Removed Values Added
References
  • {'url': 'https://hackmd.io/@noka/B1qwCyR9ll', 'source': 'cna@vuldb.com'}
  • {'url': 'https://hackmd.io/@noka/B1qwCyR9ll#%E2%9E%A4-Payload', 'source': 'cna@vuldb.com'}
  • () https://karinagante.github.io/cve-2025-10909/ -
  • () https://karinagante.github.io/cve-2025-10909/#proof-of-concept-poc -

13 Oct 2025, 17:15

Type Values Removed Values Added
Summary (en) A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way. (en) A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

24 Sep 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-24 17:15

Updated : 2026-06-17 08:29

NVD link : CVE-2025-10909

Mitre link : CVE-2025-10909

CVE.ORG link : CVE-2025-10909

JSON object : View

Products Affected

No product.

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')