PT-2025-39368 · Unknown · Nuz007 Smsboom

Dev03303 · Published 2025-09-25 · Updated 2025-09-25 · CVE-2025-10946

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions nuz007 smsboom versions prior to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674

Description A flaw exists in nuz007 smsboom. Manipulation of the hm argument in an unknown function within the dy.php file can lead to cross site scripting. Remote exploitation is possible.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-10946

Affected Products

Nuz007 Smsboom

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10946 · Security Note
• https://github.com/nuz007/smsboom/blob/main/dy.php#L20 · Note
• https://twitter.com/CVEnew/status/1971199923518411222 · Twitter Post
• https://t.me/cveNotify/136384 · Telegram Post
• https://vuldb.com/?submit.651887 · Note
• https://vuldb.com/?id.325816 · Note
• https://vuldb.com/?ctiid.325816 · Note