CVE-2025-62613

    Dashboard / Vulnerabilities / CVE-2025-62613

    CVE-2025-62613

    Published: 22 Oct 2025Last Modified: 10 Oct 2026

    Summary: VDO.Ninja Reflected XSS Vulnerability in control.html

    Details: VDO.Ninja is a tool that brings remote video feeds into OBS or other studio software via WebRTC. From versions 28.0 to before 28.4, a reflected Cross-Site Scripting (XSS) vulnerability exists on examples/control.html through the room parameter, which is improperly sanitized before being rendered in the DOM. The application fails to validate and encode user input, allowing malicious scripts to be injected and executed. This issue has been patched in version 28.4.

    References: https://github.com/steveseguin/vdo.ninja/releases/tag/v28.4, https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62613.json, https://github.com/steveseguin/vdo.ninja/security/advisories/GHSA-mp9c-cpch-x73c, https://nvd.nist.gov/vuln/detail/CVE-2025-62613, https://github.com/steveseguin/vdo.ninja/commit/83c0ac753ad60c7a086daced3244688cabd4f6b8

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- bd002bf13579fc0321e164d91ecbe2975a3148e4
    Fixed -fa3df7a160a8bcd0eddf8477048ed172d5cc5fea

    Affected versions

    v28.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2025-62613 | CVE-DB