vion707 DMadmin CVE-2025-14722

Q: What is the CVSS score of CVE-2025-14722?

CVE-2025-14722 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-12-15 cna@vuldb.com

PHP XSS

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 02:47 vuln.today

DescriptionCVE.org

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Stored cross-site scripting (XSS) vulnerability in vion707 DMadmin backend allows high-privilege authenticated users to inject malicious scripts via the Add function in AddonsController, affecting the application's integrity. The vulnerability requires user interaction (UI:P) and high-privilege access (PR:H), limiting real-world exploitation risk despite a network attack vector. Public exploit code is available, but the extremely low CVSS score (1.9) and EPSS probability (0.05th percentile) suggest minimal practical risk in typical deployments.

Technical ContextAI

The vulnerability exists in the Add function of the Admin/Controller/AddonsController.class.php component, a PHP-based backend controller responsible for managing addon functionality. The root cause is improper input validation and output encoding (CWE-79 Improper Neutralization of Input During Web Page Generation), allowing attacker-supplied data to be reflected or stored without sanitization. vion707 DMadmin implements a rolling release model, making traditional version tracking impossible; affected code was identified via commit hash (up to 3403cafdb42537a648c30bf8cbc8148ec60437d1), indicating the vulnerability exists in active development branches. The XSS payload injected through the Add function likely persists in the application's data store or session, affecting other users who view the corrupted addon data.

Affected ProductsAI

vion707 DMadmin affected up to commit hash 3403cafdb42537a648c30bf8cbc8148ec60437d1. Due to the rolling-release delivery model, traditional version numbers are not available. The vulnerability impacts the backend Admin module, specifically the AddonsController.class.php component. Precise affected product CPE cannot be determined from available data due to version unavailability. Users should reference the GitHub repository at https://github.com/DeepMountains/zzz/blob/main/CVE-2025-2-2.md and the vulnerability tracking records at https://vuldb.com/?ctiid.336467 for current patch status.

RemediationAI

No vendor-released patch identified at time of analysis due to lack of vendor response and rolling-release model. Primary remediation is to restrict backend administrative access (PR:H required for exploitation) to trusted administrators only and implement strict role-based access controls (RBAC) limiting addon management permissions. Deploy input validation and output encoding on the Add function in AddonsController.class.php-specifically, sanitize all user-supplied data using a PHP HTML filtering library (e.g., HTML Purifier) before storage and apply context-appropriate encoding (HTML entity encoding) on output. As a compensating control, implement a Web Application Firewall (WAF) rule to detect and block XSS payloads in addon parameters; note that WAF rules may generate false positives if addon functionality legitimately includes HTML or script content, requiring tuning to your specific addon use cases. Content Security Policy (CSP) headers can mitigate XSS impact if injected-set 'script-src self' to prevent inline script execution, though this may break dynamic addon features. Given the rolling-release model, monitor the GitHub repository (https://github.com/DeepMountains/zzz) for security patches and pull requests addressing this commit hash. Until a fix is available, the most practical control is administrative access restriction combined with regular security audits of addon data.