Back to Database
Status published
High
CVE-2025-55742
UnoPim Stored XSS via SVG MIME/Sanitizer Bypass
Vulnerability Description
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scripting vulnerability via SVG MIME/sanitizer bypass in the /admin/settings/users/create endpoint. This vulnerability is fixed in 0.2.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55742
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/unopim/unopim/security/advisories/GHSA-xr97-25v7-hc2q
- https://github.com/unopim/unopim/commit/49d5f6ac4d5d9ef7d9cdfe01853234d531c55f75
- https://github.com/unopim/unopim/commit/b596021b5a5e0656abe16c01ae0e84c95f9fe902
- https://github.com/unopim/unopim/commit/b5e169e65725e0d80b6c79d57e62a25e1af6a3c3
More from unopim
View All →CVE-2025-55745
UnoPim Quick Export feature is vulnerable to CSV injection
Low
2.5
CVE-2025-55744
UnoPim vulnerable to CSRF on Product edit feature and creation of other types
Medium
6.9
CVE-2025-55743
UnoPim vulnerable to remote code execution through Arbitrary File upload
High
7.3
CVE-2025-55741
unopim/unopim allows unauthorized product deletion via mass-delete endpoint
High
8.1
CVE-2024-52305
UnoPim Stored XSS : Cookie hijacking through Create User function
Medium
6.5
Affected Vendor
unopim
View all reports →Affected Software
unopim
Vulnerable Versions:
< 0.2.1
Timeline
Official Publish:
August 21st, 2025
Last Modified:
August 21st, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H