CVE-2025-66259

Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters

State: Published
Severity: 9.3 Critical
Published: Nov 26, 2025
Updated: Nov 26, 2025
Reserved: Nov 26, 2025

Description

Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in main_ok.php user supplied data/hour/time is passed directly into date shell command

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N	Gridware

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Mozart FM TransmitterDB Electronica Telecomunicazioni S.p.A.	30Affected 50Affected 100Affected 300Affected 500Affected 1000Affected 2000Affected 3000Affected 3500Affected 6000Affected 7000Affected

References

https://www.abdulmhsblog.com/posts/webfmvulns/exploittechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.