The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unrestricted file upload vulnerability in the /patch.php endpoint. An attacker with administrative credentials can upload arbitrary files (e.g., PHP webshells), which are stored in the /patch/ directory. This allows the attacker to execute arbitrary commands on the server, potentially leading to full system compromise.
CVE-2025-63227
CVSS base score
7.2 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-434
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
dbbroadcast mozart next 100 firmware
dbbroadcast mozart next 1000 firmware
dbbroadcast mozart next 2000 firmware
dbbroadcast mozart next 30 firmware
dbbroadcast mozart next 300 firmware
dbbroadcast mozart next 3000 firmware
dbbroadcast mozart next 3500 firmware
dbbroadcast mozart next 50 firmware
dbbroadcast mozart next 500 firmware
dbbroadcast mozart next 6000 firmware
References
- github.com Exploit, Third Party Advisory
- www.dbbroadcast.com Product