CVE-2025-60454: XSS

Published Oct 3, 2025

Updated

A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, specifically in the app\system\img\admin\imgadmin.class.php component. The vulnerability allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed by users.

Affected Software

2 affected components

Metinfo CMS

Metinfo Metinfo=8.0.0

Event History

Oct 3, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-60454?

CVE-2025-60454 is classified as a medium severity stored Cross-Site Scripting (XSS) vulnerability.

How do I fix CVE-2025-60454?

To fix CVE-2025-60454, it is recommended to update to the latest version of MetInfo CMS where the vulnerability has been patched.

What are the consequences of exploiting CVE-2025-60454?

Exploiting CVE-2025-60454 allows attackers to inject malicious scripts into web pages viewed by users, potentially leading to session hijacking or data theft.

Which component is affected by CVE-2025-60454?

CVE-2025-60454 affects the image management module in MetInfo CMS, specifically the img_admin.class.php component.

Can CVE-2025-60454 affect all versions of MetInfo CMS?

CVE-2025-60454 specifically affects MetInfo CMS version 8.0 and potentially earlier versions if they share the same vulnerable code.