Description
A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mangati | NovoSGA | 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | novosga/novosga | <= 2.2.9 | — | GHSA-4c44-r8rm-3p39 |
References
- VDB-325696 | Mangati NovoSGA SVG File admin cross site scripting vdb-entry technical-description
- VDB-325696 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #651379 | Mangati NovoSGA 2.2.9 Cross Site Scripting third-party-advisory
- https://karinagante.github.io/cve-2025-10909/ related
- https://karinagante.github.io/cve-2025-10909/#proof-of-concept-poc exploit