Stored Cross-Site Scripting Vulnerability in MetInfo CMS by MetInfo
CVE-2025-60451

6.1MEDIUM

Key Information:

Vendor

MetInfo

Status
MetInfo CMS
Vendor
CVE Published:
3 October 2025

What is CVE-2025-60451?

A stored Cross-Site Scripting (XSS) vulnerability is present in MetInfo CMS version 8.0, resulting from inadequate validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component. This weakness enables attackers to upload malicious SVG files that carry JavaScript code. When such files are viewed or accessed, the embedded code executes, potentially compromising user data and leading to unauthorized actions within the application.

References

https://snowhy77.github.io/2025/08/22/Stored-XSS-Vulnerab...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.