CVE-2025-28010

Published Mar 13, 2025

Last updated a day ago

CVSS medium 5.4

Overview

Description: A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 5.4
Impact score: 2.7
Exploitability score: 2.3
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:modx:modx:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7CE7BC48-9EB6-4B96-867E-C353863B4834",
            "versionEndIncluding": "3.1.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References