CVE-2025-28010

PoC —

CVSS 3.1

5.4 medium

EPSS

<1%p17

Published

Mar 13, 2025 (Mar 13, 2025)

Modified

Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

Vendors: modx
Products: modx
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.