GHSA-hm54-fg2w-2g6j

ghsaUSosv

MODX allows cross-site scripting (XSS) via an SVG file

view advisory published 2025-03-13Licence: CC-BY-4.0

A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-28010US	—	0.26% (18th)	—	2025-03-13
A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScr…

references

External citations — patches, advisories, analysis.

https://github.com/modxcms/revolutionPACKAGE
https://github.com/rtnthakur/CVE/blob/main/MODX/README.mdWEB
https://nvd.nist.gov/vuln/detail/CVE-2025-28010ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan