VulnerabilityAnalyzed

CVE-2025-61583

A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier.

MEDIUM 6.1EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability exists in the error handling mechanism of the login page, where malicious scripts embedded in server hostnames are executed in the victim's browser context without proper sanitization. This issue is fixed in version 2.2.2.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-20, CWE-80
Affected: joni1802/ts3 manager
Source: security-advisories@github.com

References

https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5ePatch
https://github.com/joni1802/ts3-manager/security/advisories/GHSA-qw6j-37r6-m93gExploit, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.