CVE-2025-10909: XSS Vulnerability in Mangati NovoSGA up to Version 2.2.9
Summary
CVE-2025-10909: Mangati NovoSGA XSS vulnerability in /admin. Affects novosga/novosga versions < 2.2.9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mangati NovoSGA is an open-source software package designed for managing and operating various administrative functions. It provides a user-friendly interface for handling tasks such as user management, data entry, and reporting. However, versions up to 2.2.9 are vulnerable to a cross-site scripting (XSS) attack, which can compromise the security of applications using this package.
Vulnerability Detail
A security flaw has been identified in the SVG File Handler component of Mangati NovoSGA, specifically in the /admin file. This vulnerability arises from improper handling of user input in the arguments logoNavbar and logoLogin, allowing attackers to inject malicious scripts. If exploited, this could lead to unauthorized actions being performed on behalf of users, potentially compromising sensitive data and user sessions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can sanitize user inputs in the affected parameters to prevent script injection. Ensure that any data rendered in the application is properly escaped to avoid execution of malicious scripts.
Conclusion
The CVE-2025-10909 vulnerability in Mangati NovoSGA poses a significant risk due to its potential for cross-site scripting attacks. Users are strongly advised to update to the latest version to safeguard their applications. In the meantime, implementing input sanitization can help mitigate risks.
See every vulnerability recorded for novosga/novosga →
FAQ
CVE-2025-10909 is a cross-site scripting vulnerability found in Mangati NovoSGA versions up to 2.2.9, allowing attackers to inject malicious scripts.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could allow attackers to perform unauthorized actions, steal user sessions, or compromise sensitive data.
Yes, the vulnerability has been patched in version 2.2.10 of Mangati NovoSGA. It is recommended to update to this version or later.
If immediate updating is not possible, ensure to sanitize user inputs and escape any data rendered in the application to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for novosga/novosga.
