Vulnerability · Published Sep 25, 2025 · Assigned by VulDB

CVE-2025-10945nuz007 smsboom d.php cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in smsboom from nuz007. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 82.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. Impacted is an unknown function of the file d.php. Such manipulation of the argument hm leads to cross site scripting. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

Affected products (as reported)

Vendor	Product	Versions
nuz007	smsboom	01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

References

VDB-325815 | nuz007 smsboom d.php cross site scripting vdb-entry, technical-description
VDB-325815 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #651886 | nuz007 smsboom master CWE-79 third-party-advisory
https://github.com/nuz007/smsboom/blob/main/d.php#L25 related