CVE-2025-28010: XSS
Published Mar 13, 2025
·Updated
A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.
Affected Software
3 affected components
composer/modx/revolution<=3.1.0
MODX MODX<=3.1.0
MODX MODX<3.1.0
Event History
Mar 13, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
Affected Software
Advisory Published
via GitHub·06:32 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-28010?
CVE-2025-28010 has a medium severity rating due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2025-28010?
To fix CVE-2025-28010, upgrade your MODX installation to version 3.1.0 or higher.
3
Who is affected by CVE-2025-28010?
CVE-2025-28010 affects all versions of MODX prior to 3.1.0.
4
What type of vulnerability is CVE-2025-28010?
CVE-2025-28010 is categorized as a cross-site scripting (XSS) vulnerability.
5
What can attackers do with CVE-2025-28010?
Attackers can exploit CVE-2025-28010 to execute malicious JavaScript in the browsers of users viewing an affected profile image.