Log in Start free

Vulnerability · Published Sep 24, 2025 · Assigned by VulDB

CVE-2025-10909Mangati NovoSGA SVG File admin cross site scripting

Low 2.4

In plain English

A low-severity cross-site scripting in NovoSGA from Mangati. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)2.4Low
Exploit odds (30 days)0.3%top 75.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistnovosga/novosgano fix listedGHSA-4c44-r8rm-3p39

Affected products (as reported)

VendorProductVersions
Mangati NovoSGA 2.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.7

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C

References