Stored Cross-Site Scripting Vulnerability in MetInfo CMS by MetInfo
CVE-2025-60450

6.1MEDIUM

Key Information:

Vendor

MetInfo

Status
MetInfo CMS
Vendor
CVE Published:
3 October 2025

What is CVE-2025-60450?

A stored Cross-Site Scripting vulnerability has been identified in MetInfo CMS version 8.0. This security issue arises from inadequate validation and sanitization processes for SVG file uploads found in the app\system\include\module\editor\Uploader.class.php component. Attackers can exploit this flaw by uploading malicious SVG files that contain executable JavaScript. When these files are accessed or viewed, the embedded code runs, potentially compromising user data or the integrity of the application.

References

https://snowhy77.github.io/2025/08/22/Stored-XSS-Vulnerab...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.