Skip to main content

PHP CVE-2025-66250

CRITICAL
Unrestricted Upload of File with Dangerous Type (CWE-434)
2025-11-26 b7efe717-a805-47cf-8e9a-921fca0ce0ce
PHP File Upload Mozart Next 100 Firmware Mozart Next 1000 Firmware Mozart Next 2000 Firmware Mozart Next 30 Firmware Mozart Next 300 Firmware Mozart Next 3000 Firmware Mozart Next 3500 Firmware Mozart Next 50 Firmware Mozart Next 500 Firmware Mozart Next 6000 Firmware Mozart Next 7000 Firmware Mozart Dds Next 30 Firmware Mozart Dds Next 50 Firmware Mozart Dds Next 100 Firmware Mozart Dds Next 300 Firmware Mozart Dds Next 500 Firmware Mozart Dds Next 1000 Firmware Mozart Dds Next 2000 Firmware Mozart Dds Next 3000 Firmware Mozart Dds Next 3500 Firmware Mozart Dds Next 6000 Firmware Mozart Dds Next 7000 Firmware
9.2
CVSS 4.0
Share

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 19:24 vuln.today
PoC Detected
Dec 03, 2025 - 16:46 vuln.today
Public exploit code
CVE Published
Nov 26, 2025 - 01:16 nvd
CRITICAL 9.2

DescriptionNVD

Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php.

AnalysisAI

Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Rated critical severity (CVSS 9.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Unauthenticated Arbitrary File Upload (status_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Allows unauthenticated arbitrary file upload via /var/tdf/status_contents.php. Affected products include: Dbbroadcast Mozart Next 100 Firmware, Dbbroadcast Mozart Next 1000 Firmware, Dbbroadcast Mozart Next 2000 Firmware, Dbbroadcast Mozart Next 30 Firmware, Dbbroadcast Mozart Next 300 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

Share

CVE-2025-66250 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy