CVE-2025-13415

Medium · 5.4

CVSS

5.4

EPSS

0.2%

Published

Nov 19, 2025

CISA due date

—

The record

A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely.

Affected packages

Ecosystem	Package	Introduced	Fixed