PT-2025-43408 · Vdo.Ninja · Vdo.Ninja

Publicado 2025-10-22 · Atualizado 2026-02-26 · CVE-2025-62613

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions VDO.Ninja versions 28.0 through 28.3

Description VDO.Ninja is a tool used to integrate remote video feeds into studio software via WebRTC. A reflected Cross-Site Scripting (XSS) issue exists in the examples/control.html file through the room parameter. The application does not properly sanitize input before rendering it in the Document Object Model (DOM), which allows for the injection and execution of malicious scripts.

Recommendations Update to version 28.4 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-62613

GHSA-MP9C-CPCH-X73C

Produtos afetados

Vdo.Ninja

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62613.json · Exploit
• https://github.com/steveseguin/vdo.ninja/releases/tag/v28.4 · Nota
• https://github.com/steveseguin/vdo.ninja/commit/83c0ac753ad60c7a086daced3244688cabd4f6b8 · Nota
• https://github.com/steveseguin/vdo.ninja/security/advisories/GHSA-mp9c-cpch-x73c · Nota
• https://twitter.com/pdnuclei_bot/status/2026945365275210205 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-62613 · Nota de Segurança
• https://twitter.com/CVEnew/status/1981219899901956387 · Publicação no Twitter
• https://t.me/cveNotify/140446 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-62613 · Aviso do Fabricante
• https://t.me/CVEtracker/35525 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1981115726208331983 · Publicação no Twitter