CVE-2025-64174 - CVE House

Back to Database

Status published Medium CVE-2025-64174

OpenMage is vulnerable to XSS in Admin Notifications

4.6 CVSS

Vulnerability Description

Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Unescaped translation strings and URLs are printed into contexts inside app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. A malicious translation or polluted data can inject script. This issue is fixed in version 20.16.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64174

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from OpenMage

View All →

Magento vulnerable to stored XSS in theme config fields

Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

Magento LTS's guest order "protect code" can be brute-forced too easily

OpenMage LTS has DoS vulnerability in MaliciousCode filter

OpenMage LTS DataFlow upload remote code execution vulnerability

Affected Vendor

OpenMage

View all reports →

Affected Software

magento-lts

Vulnerable Versions:

< 20.16.0

Timeline

Official Publish: November 6th, 2025

Last Modified: November 6th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement