CVE-2025-63229

Published: Nov 18, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting (XSS) vulnerability in the /main0.php endpoint. By injecting a malicious JavaScript payload into the ?m= query parameter, an attacker can execute arbitrary code in the victim's browser, potentially stealing sensitive information, hijacking sessions, or performing unauthorized actions.

Affected (22)

Dbbroadcast

22 products

Mozart Next 100 Firmware

Mozart Next 1000 Firmware

Mozart Next 2000 Firmware

Mozart Next 30 Firmware

Mozart Next 300 Firmware

Mozart Next 3000 Firmware

Mozart Next 3500 Firmware

Mozart Next 50 Firmware

Mozart Next 500 Firmware

Mozart Next 6000 Firmware

Mozart Next 7000 Firmware

Mozart Dds Next 30 Firmware

Mozart Dds Next 50 Firmware

Mozart Dds Next 100 Firmware

Mozart Dds Next 300 Firmware

Mozart Dds Next 500 Firmware

Mozart Dds Next 1000 Firmware

Mozart Dds Next 2000 Firmware

Mozart Dds Next 3000 Firmware

Mozart Dds Next 3500 Firmware

Mozart Dds Next 6000 Firmware

Mozart Dds Next 7000 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 100 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 1000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 1000	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 2000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 2000	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 30 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 30	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 300 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 300	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 3000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 3000	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 3500 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 3500	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 50 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 50	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 500 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 500	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 6000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 6000	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Next 7000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Next 7000	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 30 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 30	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 50 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 50	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 100 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 100	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 300 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 300	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 500 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 500	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 1000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 1000	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 2000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 2000	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 3000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 3000	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 3500 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 3500	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 6000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 6000	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Dbbroadcast Mozart Dds Next 7000 Firmware	All versions

Running on/with	Platform Versions
Dbbroadcast Mozart Dds Next 7000	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63229_Mozart_FM_Transmitter_xss

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.dbbroadcast.com/

Source: cve@mitre.org

Product

Timeline

No history available yet.