GHSA-qv78-c8hc-438r
NoneCVSS
—
EPSS
—
Published
Nov 3, 2025
CISA due date
—
The record
OpenMage vulnerable to XSS in Admin Notifications
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | openmage/magento-lts | 0 | 20.16.0 |
Related vulnerabilities
- CVE-2025-64174 Magento-lts is a long-term support alternative to Magento Community Edition (CE). Same vulnerability
- CVE-2026-25523 Magento-lts is a long-term support alternative to Magento Community Edition (CE). Also affects openmage/magento-lts
- GHSA-jg68-vhv3-9r8f Magento's X-Original-Url header can expose admin url Also affects openmage/magento-lts
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79