From 1d164750041a506b6c88fa43b210d7f955aaae10 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Thu, 13 Mar 2025 19:56:17 +0000
Subject: [PATCH] Publish Advisories

GHSA-hm54-fg2w-2g6j
GHSA-hm54-fg2w-2g6j
---
 .../GHSA-hm54-fg2w-2g6j.json                  | 61 +++++++++++++++++++
 .../GHSA-hm54-fg2w-2g6j.json                  | 29 ---------
 2 files changed, 61 insertions(+), 29 deletions(-)
 create mode 100644 advisories/github-reviewed/2025/03/GHSA-hm54-fg2w-2g6j/GHSA-hm54-fg2w-2g6j.json
 delete mode 100644 advisories/unreviewed/2025/03/GHSA-hm54-fg2w-2g6j/GHSA-hm54-fg2w-2g6j.json

diff --git a/advisories/github-reviewed/2025/03/GHSA-hm54-fg2w-2g6j/GHSA-hm54-fg2w-2g6j.json b/advisories/github-reviewed/2025/03/GHSA-hm54-fg2w-2g6j/GHSA-hm54-fg2w-2g6j.json
new file mode 100644
index 00000000000..8b2f84f8be7
--- /dev/null
+++ b/advisories/github-reviewed/2025/03/GHSA-hm54-fg2w-2g6j/GHSA-hm54-fg2w-2g6j.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-hm54-fg2w-2g6j",
+  "modified": "2025-03-13T19:55:06Z",
+  "published": "2025-03-13T18:32:21Z",
+  "aliases": [
+    "CVE-2025-28010"
+  ],
+  "summary": "MODX allows cross-site scripting (XSS) via an SVG file",
+  "details": "A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "modx/revolution"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "3.1.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28010"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/modxcms/revolution"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rtnthakur/CVE/blob/main/MODX/README.md"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "LOW",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-13T19:55:06Z",
+    "nvd_published_at": "2025-03-13T16:15:27Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/03/GHSA-hm54-fg2w-2g6j/GHSA-hm54-fg2w-2g6j.json b/advisories/unreviewed/2025/03/GHSA-hm54-fg2w-2g6j/GHSA-hm54-fg2w-2g6j.json
deleted file mode 100644
index 99d587db9a4..00000000000
--- a/advisories/unreviewed/2025/03/GHSA-hm54-fg2w-2g6j/GHSA-hm54-fg2w-2g6j.json
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-hm54-fg2w-2g6j",
-  "modified": "2025-03-13T18:32:21Z",
-  "published": "2025-03-13T18:32:21Z",
-  "aliases": [
-    "CVE-2025-28010"
-  ],
-  "details": "A cross-site scripting (XSS) vulnerability has been identified in MODX prior to 3.1.0. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.",
-  "severity": [],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-28010"
-    },
-    {
-      "type": "WEB",
-      "url": "https://github.com/rtnthakur/CVE/blob/main/MODX/README.md"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2025-03-13T16:15:27Z"
-  }
-}
\ No newline at end of file