Stored Cross-Site Scripting Vulnerability in MetInfo CMS Image Management Module
CVE-2025-60454

6.1MEDIUM

Key Information:

Vendor

MetInfo

Status
MetInfo CMS
Vendor
CVE Published:
3 October 2025

What is CVE-2025-60454?

A vulnerability has been identified in the MetInfo CMS image management module, which allows attackers to exploit the system by uploading malicious SVG files embedded with JavaScript code. When these files are accessed by users, the code executes in their browsers, potentially leading to unauthorized actions and data exposure. This highlights the need for robust security measures to validate and sanitize file uploads within the CMS.

References

https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetIn...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.