CVE-2025-60453: XSS

Published Oct 3, 2025

Updated

A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, specifically in the app\system\column\admin\index.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.

Affected Software

2 affected components

Metinfo CMS

Metinfo Metinfo=8.0.0

Event History

Oct 3, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60453?

CVE-2025-60453 has been classified as a high severity stored Cross-Site Scripting (XSS) vulnerability.

How do I fix CVE-2025-60453?

To fix CVE-2025-60453, update MetInfo CMS to the latest version that addresses the vulnerability.

What components are affected by CVE-2025-60453?

CVE-2025-60453 affects the column management module within the app\system\column\admin\index.class.php component of MetInfo CMS.

Can CVE-2025-60453 be exploited remotely?

Yes, CVE-2025-60453 can be exploited remotely by attackers to execute malicious scripts.

What types of attacks can be carried out due to CVE-2025-60453?

CVE-2025-60453 can allow attackers to perform stored XSS attacks, potentially compromising user sessions and sensitive data.