Stored Cross-Site Scripting Vulnerability in MetInfo CMS by MetInfo
CVE-2025-60453

6.1MEDIUM

Key Information:

Vendor

MetInfo

Status
MetInfo CMS
Vendor
CVE Published:
3 October 2025

What is CVE-2025-60453?

A stored Cross-Site Scripting (XSS) vulnerability in MetInfo CMS version 8.0 allows attackers to upload harmful SVG files containing JavaScript. This occurs within the column management module, specifically in the app/system/column/admin/index.class.php component. When these malicious files are accessed or viewed, the embedded code executes, potentially compromising user security and data integrity. It highlights the need for careful handling and validation of uploaded files to prevent exploitation.

References

https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetIn...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.