The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting (XSS) vulnerability in the /main0.php endpoint. By injecting a malicious JavaScript payload into the ?m= query parameter, an attacker can execute arbitrary code in the victim's browser, potentially stealing sensitive information, hijacking sessions, or performing unauthorized actions.
CVE-2025-63229
CVSS base score
5.4 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-79
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
dbbroadcast mozart next 100 firmware
dbbroadcast mozart next 1000 firmware
dbbroadcast mozart next 2000 firmware
dbbroadcast mozart next 30 firmware
dbbroadcast mozart next 300 firmware
dbbroadcast mozart next 3000 firmware
dbbroadcast mozart next 3500 firmware
dbbroadcast mozart next 50 firmware
dbbroadcast mozart next 500 firmware
dbbroadcast mozart next 6000 firmware
References
- github.com Exploit, Third Party Advisory
- www.dbbroadcast.com Product