Listen to this Post
The CVE-2025-63229 vulnerability is a reflected Cross-Site Scripting (XSS) flaw in the Mozart FM Transmitter web management interface, version WEBMOZZI-00287. It resides in the `/main0.php` endpoint, specifically within the `?m=` query parameter. User input passed via this parameter is not properly sanitized or encoded before being reflected in the server’s HTTP response. An attacker can craft a URL containing a malicious JavaScript payload within the `?m=` parameter. When a victim visits this crafted URL, the payload is executed directly in their browser context. This allows arbitrary JavaScript execution, enabling actions such as stealing session cookies, authentication tokens, or performing unauthorized administrative requests against the web interface, compromising the device management system.
Platform: Mozart FM Transmitter
Version: WEBMOZZI-00287
Vulnerability: Reflected XSS
Severity: Critical
Date: 11/18/2025
Prediction: Patch Q1 2026
What Undercode Say:
Analytics
curl -s “http://TARGET/main0.php?m=”
how Exploit:
Craft malicious URL.
Phish victim click.
Execute stolen cookies.
Protection from this CVE
Input validation encoding.
Content Security Policy.
Firmware patch update.
Impact:
Session hijacking theft.
Unauthorized device control.
Data exfiltration risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
