Packagist/novosga/novosga CVE-2025-10909: low 2.4, EPSS 0.31%
Mangati NovoSGA XSS vulnerability in /admin
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 2.2.9 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-4c44-r8rm-3p39
- https://nvd.nist.gov/vuln/detail/CVE-2025-10909
- https://github.com/novosga/novosga
- https://hackmd.io/@noka/B1qwCyR9ll
- https://hackmd.io/@noka/B1qwCyR9ll#%E2%9E%A4-Payload
- https://vuldb.com/?ctiid.325696
- https://vuldb.com/?id.325696
- https://vuldb.com/?submit.651379
CVE-2025-10909 · published · modified · JSON