What is GHSA-hm54-fg2w-2g6j?

GHSA-hm54-fg2w-2g6j is a security advisory published by GitHub Security Advisories with Low severity. MODX allows cross-site scripting (XSS) via an SVG file

Which CVE IDs does GHSA-hm54-fg2w-2g6j cover?

GHSA-hm54-fg2w-2g6j covers the following CVE IDs: CVE-2025-28010. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hm54-fg2w-2g6j?

GHSA-hm54-fg2w-2g6j has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-hm54-fg2w-2g6j?

GHSA-hm54-fg2w-2g6j affects 1 product, including: composer/modx/revolution:\u003c= 3.1.0.

GHSA-hm54-fg2w-2g6jLowCVSS 5.4

MODX allows cross-site scripting (XSS) via an SVG file

Vendor

GitHub Security Advisories

Published

March 13, 2025

Last Modified

March 19, 2025

🔗 CVE IDs covered (1)

CVE-2025-28010 →

📋 Description

A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

🎯 Affected products1

composer/modx/revolution:<= 3.1.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2025-28010
https://github.com/rtnthakur/CVE/blob/main/MODX/README.md
https://github.com/advisories/GHSA-hm54-fg2w-2g6j