PT-2025-47411 · Unknown · Mozart Fm Transmitter

Published 2025-11-18 · Updated 2025-12-06 · CVE-2025-63229

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mozart FM Transmitter version WEBMOZZI-00287

Description The Mozart FM Transmitter web management interface is susceptible to a reflected Cross-Site Scripting (XSS) issue. An attacker can inject a malicious JavaScript payload into the ?m= query parameter of the '/main0.php' endpoint. Successful exploitation allows the execution of arbitrary code within the victim’s browser, potentially leading to the theft of sensitive data, session hijacking, or unauthorized actions.

Recommendations Apply input validation and output encoding to the ?m= query parameter in the '/main0.php' endpoint.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63229

Affected Products

Mozart Fm Transmitter

References · 8

• 🔥 https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63229_Mozart_FM_Transmitter_xss · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63229 · Security Note
• https://t.me/CVEtracker/37681 · Telegram Post
• https://t.me/cveNotify/143348 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1990989692041314474 · Twitter Post
• https://dbbroadcast.com · Note
• https://twitter.com/dailycve/status/1997125129613025303 · Twitter Post
• https://twitter.com/CVEnew/status/1991066224726508017 · Twitter Post