CVE-2025-60452: XSS

Published Oct 3, 2025

Updated

A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, specifically in the app\system\download\admin\downloadadmin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.

Affected Software

2 affected components

Metinfo CMS

Metinfo Metinfo=8.0.0

Event History

Oct 3, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60452?

CVE-2025-60452 is classified as a stored Cross-Site Scripting (XSS) vulnerability.

How do I fix CVE-2025-60452?

To fix CVE-2025-60452, ensure that you upgrade to a patched version of MetInfo CMS that addresses this vulnerability.

What are the potential impacts of CVE-2025-60452?

If exploited, CVE-2025-60452 can allow attackers to execute arbitrary scripts in the context of the user's browser.

Which component in MetInfo CMS is affected by CVE-2025-60452?

CVE-2025-60452 affects the download management module located in the download_admin.class.php component.

What versions of MetInfo CMS are affected by CVE-2025-60452?

CVE-2025-60452 affects MetInfo CMS version 8.0.