Vulnerability · Published Nov 26, 2025 · Assigned by Gridware

CVE-2025-66258Stored Cross-Site Scripting via XML Injection

High 7.1

In plain English

A high-severity cross-site scripting in Mozart FM Transmitter from DB Electronica Telecomunicazioni S.p.A.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 89.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Stored XSS via crafted filenames injected into patchlist.xml. User-controlled filenames are directly concatenated into `patchlist.xml` without encoding, allowing injection of malicious JavaScript payloads via crafted filenames (e.g., `<img src=x onerror=alert()>.bin`). The XSS executes when ajax.js processes and renders the XML file.

Affected products (as reported)

Vendor	Product	Versions
DB Electronica Telecomunicazioni S.p.A.	Mozart FM Transmitter	3050100300500100020003000

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N

References

https://www.abdulmhsblog.com/posts/webfmvulns/ exploit, technical-description