CVE-2025-45893: 
OpenCart vulnerability analysis and mitigation

OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability was discovered on July 25, 2025, and affects the media manager functionality where SVG files are not properly sanitized (NVD).

The vulnerability arises from improper sanitization of SVG files uploaded through the media manager in OpenCart's blog post feature. The CVSS v3.1 base score is 6.1 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (AttackerKB).

The successful exploitation of this vulnerability could allow attackers to execute arbitrary web scripts or HTML through crafted SVG files. This could lead to unauthorized access to sensitive information and potential manipulation of web content, affecting both confidentiality and integrity of the system with low impact (NVD).