CVE-2025-55742 json
UnoPim Stored XSS via SVG MIME/Sanitizer Bypass
published last yr. modified 4mo ago also EUVD-2025-25457 , GHSA-xr97-25v7-hc2q
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1.
Patch / fix
- packagist unopim/unopim 0.2.1
- webkul unopim 0.2.1
Is CVE-2025-55742 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- github.com https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | unopim/unopim | <0.2.1 |
0.2.1 |
Affected products
- unopim unopim
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75
web, patch
-
github.com
/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902
web, patch
-
github.com
/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3
web, patch
-
github.com
/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-55742
advisory
-
drive.proton.me
/urls/KCKTSWHA3C#W2Zus8hWucj2
web
-
github.com
/unopim/unopim
package
-
github.com
/unopim/unopim/blob/a0dc81947a59ada69e19e1e4313dd591d4e277b4/packages/Webkul/Core/src/Traits/Sanitizer.php#L9-
web
Sources
- CVE List CVE-2025-55742
- GitHub Advisory GHSA-xr97-25v7-hc2q
- NVD CVE-2025-55742
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.