CVE-2025-60450: XSS

Published Oct 3, 2025

Updated

A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.

Affected Software

2 affected components

Metinfo MetInfo CMS

Metinfo Metinfo=8.0.0

Event History

Oct 3, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60450?

CVE-2025-60450 is classified as a critical vulnerability due to its potential for stored Cross-Site Scripting (XSS) attacks.

How do I fix CVE-2025-60450?

To fix CVE-2025-60450, ensure proper validation and sanitization of SVG file uploads in the MetInfo CMS application.

Which software is affected by CVE-2025-60450?

CVE-2025-60450 affects MetInfo CMS version 8.0 and potentially earlier versions.

What type of vulnerability is CVE-2025-60450?

CVE-2025-60450 is a stored Cross-Site Scripting (XSS) vulnerability.

What are the implications of CVE-2025-60450?

CVE-2025-60450 allows attackers to execute arbitrary scripts on the affected web application, compromising user data and sessions.