CVE Feed

    Dashboard / CVE / CVE-2025-63229

    CVE-2025-63229

    The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting (XSS) vulnerability in the /main0.php endpoint. By injecting a malicious JavaScript payload into the ?m= query parameter, an attacker can execute arbitrary code in the victim's browser, potentially stealing sensitive information, hijacking sessions, or performing unauthorized actions.

    Published:Nov 18, 2025
    Last Modified:Dec 6, 2025
    EPS:Nov 18, 2025
    EPSS Score:0.00039
    CVSS Score:5.4

    Affected Products

    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 100
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 1000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 1000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 100 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 2000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 2000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 30
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 300
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 3000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 3000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 300 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 30 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 3500
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 3500 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 50
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 500
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 500 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 50 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 6000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 6000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 7000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 7000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Fm Transmitter
    Vendor
    Dbbroadcast
    Product
    Mozart Next 100
    Vendor
    Dbbroadcast
    Product
    Mozart Next 1000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 1000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 100 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 2000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 2000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 30
    Vendor
    Dbbroadcast
    Product
    Mozart Next 300
    Vendor
    Dbbroadcast
    Product
    Mozart Next 3000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 3000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 300 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 30 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 3500
    Vendor
    Dbbroadcast
    Product
    Mozart Next 3500 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 50
    Vendor
    Dbbroadcast
    Product
    Mozart Next 500
    Vendor
    Dbbroadcast
    Product
    Mozart Next 500 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 50 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 6000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 6000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 7000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 7000 Firmware

    Exploits

    https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63229_Mozart_FM_Transmitter_xss

    Related CVEs

    CVE-2025-66263 (CVSS 8.9) — Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart …
    CVE-2025-66262 (CVSS 9.3) — Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A. Mozart F…
    CVE-2025-66261 (CVSS 9.9) — Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart …
    CVE-2025-66260 (CVSS 7.2) — PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter ver…
    CVE-2025-66259 (CVSS 9.3) — Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni…
    CVE-2025-66258 (CVSS 7.1) — Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter…
    CVE-2025-66257 (CVSS 9.2) — Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart…
    CVE-2025-66256 (CVSS 9.9) — Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart F…
    CVE-2025-66255 (CVSS 9.9) — Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart…
    CVE-2025-66254 (CVSS 7.8) — Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Moza…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High