CVE-2025-65229: Cross-site Scripting
Source CVE Database V5
Not known to be exploited · CVSS 4.6 Medium.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 8 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-65229, European organizations should implement the following specific measures: 1) Restrict access to the Settings Player interface strictly to trusted and necessary personnel to reduce the attack surface. 2) Implement input validation and output encoding on the Player name field to neutralize any HTML or JavaScript content before storage and rendering. 3) Monitor web interface logs for unusual or suspicious input patterns indicative of attempted XSS injection. 4) Educate users with access about the risks of stored XSS and encourage cautious behavior when interacting with Player Info tabs. 5) If possible, apply web application firewall (WAF) rules to detect and block XSS payloads targeting this interface. 6) Segregate user roles and enforce least privilege principles to limit the ability of authenticated users to modify Player names. 7) Regularly review and update the Lyrion Music Server software and monitor vendor communications for official patches or security advisories. 8) Consider isolating the management interface from general user networks to reduce exposure. These targeted actions go beyond generic advice by focusing on access control, input sanitization, monitoring, and user education specific to the vulnerability context.
Description
A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with access to Settings Player can save arbitrary HTML/JavaScript in the Player name field. That value is stored by the server and later rendered without proper output encoding on the Information (Player Info) tab, causing the script to execute in the context of any user viewing that page.