PT-2025-9112

CVE-2025-27400

Published

2025-02-28

Updated

2025-06-16

Description by

CVSS 3.1

2.9

Low

MetricsAV:A/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Magento Long Term Support (LTS) versions prior to 20.12.3 Magento Long Term Support (LTS) versions prior to 20.13.1

Description The issue allows script execution in the admin panel, potentially leading to cross-site scripting against authenticated admin users. The attack requires an admin user with configuration access.

Recommendations For versions prior to 20.12.3, update to version 20.12.3 to resolve the issue. For versions prior to 20.13.1, update to version 20.13.1 to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Justlife4X4

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2025-27400