PT-2025-11447 · Unknown · Vam Virtual Airlines Manager

Davimo · Published 2025-03-17 · Updated 2025-03-17 · CVE-2025-2354

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions VAM Virtual Airlines Manager version 2.6.2

Description A vulnerability has been found in VAM Virtual Airlines Manager, affecting an unknown functionality of the file /vam/index.php. The manipulation of the argument registry id/plane icao/hub id leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For version 2.6.2, as a temporary workaround, consider restricting access to the /vam/index.php file until a patch is available. Avoid using the argument registry id/plane icao/hub id in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-2354

Affected Products

Vam Virtual Airlines Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-2354 · Security Note
• https://t.me/cvetracker/19242 · Telegram Post
• https://t.me/cvedetector/20423 · Telegram Post
• https://vuldb.com/?submit.513287 · Note
• https://vuldb.com/?id.299821 · Note
• https://t.me/cvenotify/114972 · Telegram Post
• https://vuldb.com/?ctiid.299821 · Note