CVE-2025-63229: n/a
Source CVE Database V5
Not known to be exploited · CVSS 5.4 Medium.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 18 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-63229, organizations should implement strict input validation and output encoding on the ?m= query parameter to neutralize malicious scripts. If vendor patches become available, immediate application is critical. Until then, restrict access to the web management interface to trusted internal networks using network segmentation, VPNs, or firewall rules. Employ web application firewalls (WAFs) with custom rules to detect and block XSS payloads targeting the /main0.php endpoint. Educate users and administrators about the risks of clicking untrusted links and encourage cautious behavior. Regularly monitor logs for suspicious access patterns or repeated attempts to exploit the vulnerability. Consider deploying browser security features such as Content Security Policy (CSP) to limit script execution. Finally, review and harden authentication mechanisms to reduce the impact of session hijacking.
Description
The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting (XSS) vulnerability in the /main0.php endpoint. By injecting a malicious JavaScript payload into the ?m= query parameter, an attacker can execute arbitrary code in the victim's browser, potentially stealing sensitive information, hijacking sessions, or performing unauthorized actions.