CVE-2025-10909

Mangati NovoSGA SVG File admin cross site scripting

State: Published
Severity: 4.8 Medium
Published: Sep 24, 2025
Updated: Oct 20, 2025
Reserved: Sep 24, 2025

Description

A security flaw has been discovered in Mangati NovoSGA up to 2.2.9. The impacted element is an unknown function of the file /admin of the component SVG File Handler. Performing manipulation of the argument logoNavbar/logoLogin results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	2.4 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C	VulDB
3.0	2.4 Low	CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C	VulDB
2.0	3.3 Low	AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C	VulDB
3.1	2.1 Low	CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N	CISA-ADP

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
NovoSGAMangati	2.2.0Affected 2.2.1Affected 2.2.2Affected 2.2.3Affected 2.2.4Affected 2.2.5Affected 2.2.6Affected 2.2.7Affected 2.2.8Affected 2.2.9Affected

References

VDB-325696 | Mangati NovoSGA SVG File admin cross site scriptingvdb-entrytechnical-description
VDB-325696 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #651379 | Mangati NovoSGA 2.2.9 Cross Site Scriptingthird-party-advisory
https://karinagante.github.io/cve-2025-10909/related
https://karinagante.github.io/cve-2025-10909/#proof-of-concept-pocexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.