Cross-Site Scripting Vulnerability in VAM Virtual Airlines Manager by VAM

CVE-2025-2354

What is CVE-2025-2354?

A cross-site scripting vulnerability exists in the Virtual Airlines Manager software version 2.6.2, specifically within the index.php file. This vulnerability arises due to improper handling of user-supplied input through the parameters registry_id, plane_icao, and hub_id, allowing attackers to inject malicious scripts. Remote exploitation is possible, making it crucial for users to be aware of the risks and potential impact on their web applications. The vendor has been notified of this issue but has not provided a response, raising concerns about accountability and timely mitigation.

References