VulnerabilityAnalyzed

CVE-2025-10366

This manipulation of the argument Email address causes cross site scripting.

LOW 2.0EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

A flaw has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/inc.setWlanIpMail.php. This manipulation of the argument Email address causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0: 2.0 LOWCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.29% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-79, CWE-94
Affected: sourcefabric/rpi-jukebox-rfid
Source: cna@vuldb.com

References

https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss1.mdExploit, Third Party Advisory
https://github.com/YZS17/CVE/blob/main/RPi-Jukebox-RFID/xss1.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.323774Permissions Required, VDB Entry
https://vuldb.com/?id.323774Third Party Advisory, VDB Entry
https://vuldb.com/?submit.643517Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.