Stored Cross-Site Scripting Vulnerability in MetInfo CMS
CVE-2025-60452

6.1MEDIUM

Key Information:

Vendor

MetInfo

Status
MetInfo CMS
Vendor
CVE Published:
3 October 2025

What is CVE-2025-60452?

A stored Cross-Site Scripting vulnerability has been identified in the MetInfo CMS, particularly affecting version 8.0 within the download management module. This issue enables attackers to upload specially crafted SVG files that contain malicious JavaScript code. When these files are subsequently viewed or accessed by users, the embedded script executes, potentially compromising user data and application integrity. The vulnerability emphasizes the need for robust input validation and content filtering to mitigate these security risks.

References

https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetIn...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.