CVE-2025-63229
The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting (XSS) vulnerability in the /main0.php endpoint.
Does this matter?
Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.
Description
The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting (XSS) vulnerability in the /main0.php endpoint. By injecting a malicious JavaScript payload into the ?m= query parameter, an attacker can execute arbitrary code in the victim's browser, potentially stealing sensitive information, hijacking sessions, or performing unauthorized actions.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- EPSS
- 0.28% probability · 20th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- dbbroadcast/mozart next 100 firmware · dbbroadcast/mozart next 1000 firmware · dbbroadcast/mozart next 2000 firmware · dbbroadcast/mozart next 30 firmware · dbbroadcast/mozart next 300 firmware · dbbroadcast/mozart next 3000 firmware · dbbroadcast/mozart next 3500 firmware · dbbroadcast/mozart next 50 firmware · dbbroadcast/mozart next 500 firmware · dbbroadcast/mozart next 6000 firmware · dbbroadcast/mozart next 7000 firmware · dbbroadcast/mozart dds next 30 firmware · dbbroadcast/mozart dds next 50 firmware · dbbroadcast/mozart dds next 100 firmware · dbbroadcast/mozart dds next 300 firmware · dbbroadcast/mozart dds next 500 firmware · dbbroadcast/mozart dds next 1000 firmware · dbbroadcast/mozart dds next 2000 firmware · dbbroadcast/mozart dds next 3000 firmware · dbbroadcast/mozart dds next 3500 firmware · +2 more
- Source
- cve@mitre.org
References
- https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63229_Mozart_FM_Transmitter_xssExploit, Third Party Advisory
- https://www.dbbroadcast.com/Product
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.