CVE-2025-10909
low
CVSS v3
2.4
CVSS v2
3.3
VIR risk
2.4
Description
Mangati NovoSGA XSS vulnerability in /admin
Predictions
Exploit likelihood
36%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | novosga/novosga | <=2.2.9 | |
References
- https://karinagante.github.io/cve-2025-10909/
- https://karinagante.github.io/cve-2025-10909/#proof-of-concept-poc
- https://vuldb.com/?ctiid.325696
- https://vuldb.com/?id.325696
- https://vuldb.com/?submit.651379
- https://nvd.nist.gov/vuln/detail/CVE-2025-10909
- https://github.com/novosga/novosga
- https://hackmd.io/@noka/B1qwCyR9ll
- https://hackmd.io/@noka/B1qwCyR9ll#%E2%9E%A4-Payload
CWEs
CWE-79 CWE-94
Verify integrity in audit chain (admin only). AS-IS.