CVE-2025-28010

A cross-site scripting XSS vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image...

CVE-2025-28010

The modx/revolution Content Management System (versions prior to 3.1.0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is improper sanitization and validation of user-uploaded SVG files in the profile image upload feature. An authenticated attacker can upload ...