GitHub Advisoryadvisory · Packagist

GHSA-hm54-fg2w-2g6j MODX allows cross-site scripting (XSS) via an SVG file

LOW Published 2025-03-13 Modified 2025-03-19 Official page ↗
Aliases
CVE-2025-28010
Ecosystem
Packagist
Packages
modx/revolution
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-03-13

Affected packages

• Packagist modx/revolution: <= 3.1.0 (no fix yet)

Description

A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

Related

Alias · CVE (1)

  • CVE-2025-28010 A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References