Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\editor\Uploader.class.php component. This security flaw allows attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed or accessed.

CVE-2025-60450 is a stored Cross-Site Scripting (XSS) vulnerability identified in MetInfo CMS version 8.0. The root cause of this vulnerability lies in the insufficient validation and sanitization of SVG file uploads handled by the component located at app\system\include\module\editor\Uploader.class.php. Specifically, attackers can upload malicious SVG files that embed JavaScript code. When these SVG files are viewed or accessed within the CMS environment, the embedded JavaScript executes in the context of the victim's browser. This stored XSS vulnerability allows an attacker to persist malicious scripts on the server, which can then be triggered by any user who accesses the compromised SVG file. The CVSS 3.1 base score is 6.1, indicating a medium severity level. The vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows that the attack can be performed remotely over the network without privileges, requires low attack complexity, no privileges, but does require user interaction (such as viewing the SVG). The scope is changed, meaning the vulnerability affects components beyond the initially vulnerable component. The impact affects confidentiality and integrity to a low degree but does not affect availability. This vulnerability is categorized under CWE-79 (Improper Neutralization of Input During Web Page Generation), which is typical for XSS issues. No known exploits are reported in the wild yet, and no patches have been linked at the time of publication. The vulnerability is significant because SVG files are commonly used for vector graphics on websites, and many CMS platforms allow SVG uploads for flexibility in content management. Attackers exploiting this flaw could execute arbitrary scripts in the context of users' browsers, potentially leading to session hijacking, defacement, or redirection to malicious sites. Since the vulnerability requires user interaction (viewing the SVG), social engineering or phishing tactics may be used to lure victims into triggering the payload. The vulnerability affects MetInfo CMS, a content management system that is less globally widespread than some others but is used in various regions for website management, including some European organizations. The lack of a patch at the time of disclosure necessitates immediate mitigation steps to reduce risk.

Detailed information about CVE-2025-60450: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-60450: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-60450: n/a

Threats Tagged 'cve-2025-60450'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-60450'

Lead Pen Test Professional