PT-2026-5134 · Unknown · Podcast Generator

Published 2026-01-28 · Updated 2026-02-09 · CVE-2025-70336

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PodcastGenerator version 3.2.9

Description A stored cross-site scripting (XSS) issue exists in the 'Create New Live Item' functionality. This allows remote attackers to inject arbitrary script or HTML through the TITLE, SHORT DESCRIPTION, and LONG DESCRIPTION parameters. The injected payload is executed when accessing the 'View All Live Items' and 'Live Stream' pages.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-70336

Affected Products

Podcast Generator

References · 7

• 🔥 https://github.com/aryasahil96-manu/CVE-Disclosures/blob/main/CVE-2025-70336 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70336 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70336 · Vendor Advisory
• https://github.com/PodcastGenerator/PodcastGenerator · Note
• https://t.me/cveNotify/151458 · Telegram Post
• https://twitter.com/CVEnew/status/2016541928549155051 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2016606958938144868 · Twitter Post