CVE-2025-63227
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
60/100
Published: 2025-11-18
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unrestricted file upload vulnerability in the /patch.php endpoint. An attacker with administrative credentials can upload arbitrary files (e.g., PHP webshells), which are stored in the /patch/ directory. This allows the attacker to execute arbitrary commands on the server, potentially leading to full system compromise.
Weakness Classification (1)
Affected Software (22)
References & Advisories (2)
Product
Exploit
Third Party Advisory