CVE Feed

    Dashboard / CVE / CVE-2025-66257

    CVE-2025-66257

    Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows unauthenticated deletion of arbitrary files. The `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks.

    Published:Nov 26, 2025
    Last Modified:Dec 3, 2025
    EPS:Nov 26, 2025
    EPSS Score:0.0009
    CVSS Score:9.1

    Affected Products

    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 100
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 1000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 1000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 100 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 2000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 2000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 30
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 300
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 3000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 3000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 300 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 30 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 3500
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 3500 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 50
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 500
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 500 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 50 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 6000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 6000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 7000
    Vendor
    Dbbroadcast
    Product
    Mozart Dds Next 7000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Fm Transmitter
    Vendor
    Dbbroadcast
    Product
    Mozart Next 100
    Vendor
    Dbbroadcast
    Product
    Mozart Next 1000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 1000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 100 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 2000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 2000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 30
    Vendor
    Dbbroadcast
    Product
    Mozart Next 300
    Vendor
    Dbbroadcast
    Product
    Mozart Next 3000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 3000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 300 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 30 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 3500
    Vendor
    Dbbroadcast
    Product
    Mozart Next 3500 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 50
    Vendor
    Dbbroadcast
    Product
    Mozart Next 500
    Vendor
    Dbbroadcast
    Product
    Mozart Next 500 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 50 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 6000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 6000 Firmware
    Vendor
    Dbbroadcast
    Product
    Mozart Next 7000
    Vendor
    Dbbroadcast
    Product
    Mozart Next 7000 Firmware

    Exploits

    https://www.abdulmhsblog.com/posts/webfmvulns/https://www.abdulmhsblog.com/posts/webfmvulns/

    Related CVEs

    CVE-2025-66263 (CVSS 8.9) — Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart …
    CVE-2025-66262 (CVSS 9.3) — Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A. Mozart F…
    CVE-2025-66261 (CVSS 9.9) — Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart …
    CVE-2025-66260 (CVSS 7.2) — PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter ver…
    CVE-2025-66259 (CVSS 9.3) — Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni…
    CVE-2025-66258 (CVSS 7.1) — Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter…
    CVE-2025-66256 (CVSS 9.9) — Unauthenticated Arbitrary File Upload (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart F…
    CVE-2025-66255 (CVSS 9.9) — Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart…
    CVE-2025-66254 (CVSS 7.8) — Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Moza…
    CVE-2025-66253 (CVSS 9.9) — Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High