PT-2025-40521 · Unknown · Metinfo Cms

Snowhy · Publicado 2025-10-03 · Atualizado 2025-10-07 · CVE-2025-60452

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MetInfo CMS version 8.0

Description A stored Cross-Site Scripting (XSS) issue exists in the download management module of the software. The vulnerability is located in the appsystemdownloadadmindownload admin.class.php component. Attackers can upload malicious SVG files containing JavaScript code. This code executes when a user views or accesses the uploaded file.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-60452

Produtos afetados

Metinfo Cms

Referências · 5

• 🔥 https://snowhy77.github.io/2025/08/22/Stored-XSS-in-MetInfo-Download-Module · Exploit
• https://t.me/CVEtracker/34023 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-60452 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-60452 · Nota de Segurança
• https://t.me/cveNotify/137682 · Publicação no Telegram