CVE-2025-60451: XSS

Published Oct 3, 2025

Updated

A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component, specifically in the website settings module. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.

Affected Software

2 affected components

Metinfo CMS

Metinfo Metinfo=8.0.0

Event History

Oct 3, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60451?

CVE-2025-60451 has been classified with a significant severity due to the potential for stored Cross-Site Scripting (XSS) attacks.

What impact does CVE-2025-60451 have on MetInfo CMS?

CVE-2025-60451 allows attackers to inject malicious scripts through SVG file uploads, compromising user data and site integrity.

How do I fix CVE-2025-60451?

To mitigate CVE-2025-60451, you should validate and sanitize all SVG file uploads to prevent XSS exploits.

Which versions of MetInfo CMS are affected by CVE-2025-60451?

CVE-2025-60451 affects MetInfo CMS version 8.0 and may be present in later versions if not patched.

What type of vulnerability is CVE-2025-60451?

CVE-2025-60451 is a stored Cross-Site Scripting (XSS) vulnerability, primarily affecting the upload functionality in MetInfo CMS.