PT-2025-48112 · Db Elettronica Telecomunicazioni Spa · Mozart Fm Transmitter

Abdul Mhanni · Published 2025-11-26 · Updated 2025-11-26 · CVE-2025-66258

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30 through 7000

Description The software contains a Stored Cross-Site Scripting issue due to XML Injection. An attacker can execute malicious JavaScript payloads by injecting crafted filenames into the patchlist.xml file. User-controlled filenames are directly concatenated into patchlist.xml without encoding. The XSS executes when the ajax.js file processes and renders the XML file. The vulnerable parameter is the filename.

Recommendations Versions 30 through 7000 should be updated to a newer version that contains a fix for this vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66258

Affected Products

Mozart Fm Transmitter

References · 4

• 🔥 https://abdulmhsblog.com/posts/webfmvulns · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66258 · Security Note
• https://twitter.com/VulmonFeeds/status/1993542690739212731 · Twitter Post
• https://t.me/CVEtracker/38249 · Telegram Post