Vulnerability · Published Sep 25, 2025 · Assigned by VulDB

CVE-2025-10946nuz007 smsboom dy.php cross site scripting

Low 3.5

In plain English

A low-severity cross-site scripting in smsboom from nuz007. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.3%top 82.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. The affected element is an unknown function of the file dy.php. Performing manipulation of the argument hm results in cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.

Affected products (as reported)

Vendor	Product	Versions
nuz007	smsboom	01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674

Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:X/RC:R

References

VDB-325816 | nuz007 smsboom dy.php cross site scripting vdb-entry, technical-description
VDB-325816 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #651887 | nuz007 smsboom master CWE-79 third-party-advisory
https://github.com/nuz007/smsboom/blob/main/dy.php#L20 related