PoC Index85,100 CVEs with PoCs

CVE-2025-28010

LOW 2.0EPSS 0.3%

A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.

CVSS v4.0 GitHub
2.0 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P
CVSS v3.1 CNA
5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS
0.26% chance of exploitation in the next 30 days, 17th percentile
Published
2025-03-13
Updated
2025-03-19

Proof-of-concept exploits (1)

Security advisories

References