Stored Cross-Site Scripting Vulnerability in DB Electronica Telecomunicazioni Mozart FM Transmitter

CVE-2025-66258

What is CVE-2025-66258?

A stored cross-site scripting vulnerability exists in the Mozart FM Transmitter by DB Electronica Telecomunicazioni. This vulnerability allows attackers to inject malicious JavaScript payloads into the patchlist.xml file. The issue arises from user-controlled filenames being concatenated directly into the XML file without proper encoding. When the ajax.js script processes this XML, it renders the file and executes any injected scripts, potentially compromising user security. Attackers can exploit this by uploading crafted filenames, which can lead to unauthorized actions performed in the context of a victim's browser.

References