CVE-2025-66257— Unauthenticated Arbitrary File Deletion (patch_contents.php)
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-66257
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated Arbitrary File Deletion (patch_contents.php)
Source: NVD (National Vulnerability Database)
Vulnerability Description
Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows unauthenticated deletion of arbitrary files. The `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
文件名或路径的外部可控制
Source: NVD (National Vulnerability Database)
Vulnerability Title
DB Electronica Mozart FM Transmitter 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
DB Electronica Mozart FM Transmitter是意大利DB Electronica公司的一个专业级FM广播发射机系列。 DB Electronica Mozart FM Transmitter 30版本、50版本、100版本、300版本、500版本、1000版本、2000版本、3000版本、3500版本、6000版本和7000版本存在安全漏洞，该漏洞源于deletepatch参数允许未经验证的任意文件删除，可能导致关键文件被删除。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| DB Electronica Telecomunicazioni S.p.A. | Mozart FM Transmitter | 30 | - |
II. Public POCs for CVE-2025-66257
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-66257
请登录查看更多情报信息。
Same Patch Batch · DB Electronica Telecomunicazioni S.p.A. · 2025-11-26 · 14 CVEs total
| CVE-2025-66256 | Unauthenticated Arbitrary File Upload (patch_contents.php) | |
| CVE-2025-66252 | Infinite Loop Denial of Service via Failed File Deletion | |
| CVE-2025-66255 | Unauthenticated Arbitrary File Upload (upgrade_contents.php) | |
| CVE-2025-66253 | Unauthenticated OS Command Injection (start_upgrade.php) | |
| CVE-2025-66254 | Unauthenticated Arbitrary File Deletion (upgrade_contents.php) | |
| CVE-2025-66250 | Unauthenticated Arbitrary File Upload (status_contents.php) | |
| CVE-2025-66251 | Unauthenticated Path Traversal with Arbitrary File Deletion | |
| CVE-2025-66262 | Arbitrary File Overwrite via Tar Extraction Path Traversal | |
| CVE-2025-66259 | Authenticated Root Remote Code Execution through improper filtering of HTTP post request p | |
| CVE-2025-66263 | Unauthenticated Arbitrary File Read via Null Byte Injection | |
| CVE-2025-66258 | Stored Cross-Site Scripting via XML Injection | |
| CVE-2025-66260 | PostgreSQL SQL Injection (status_sql.php) | |
| CVE-2025-66261 | Unauthenticated OS Command Injection (restore_settings.php) |
IV. Related Vulnerabilities
Same product: Mozart FM Transmitter
- CVE-2025-66263
Unauthenticated Arbitrary File Read via Null Byte Injection - CVE-2025-66262
Arbitrary File Overwrite via Tar Extraction Path Traversal - CVE-2025-66261
Unauthenticated OS Command Injection (restore_settings.php) - CVE-2025-66260
PostgreSQL SQL Injection (status_sql.php) - CVE-2025-66259
Authenticated Root Remote Code Execution through improper fi
Same vendor: DB Electronica Telecomunicazioni S.p.A.
- CVE-2025-66263
Unauthenticated Arbitrary File Read via Null Byte Injection - CVE-2025-66262
Arbitrary File Overwrite via Tar Extraction Path Traversal - CVE-2025-66261
Unauthenticated OS Command Injection (restore_settings.php) - CVE-2025-66260
PostgreSQL SQL Injection (status_sql.php) - CVE-2025-66259
Authenticated Root Remote Code Execution through improper fi
Same weakness: CWE-73
- CVE-2026-41693
i18next-fs-backend: Path traversal via unsanitised lng/ns al - CVE-2026-44127
Local File Inclusion (LFI) and Arbitrary File Deletion - CVE-2026-7633
Totolink N300RH cstecgi.cgi setUploadSetting file inclusion - CVE-2026-42424
OpenClaw < 2026.4.8 - Local File Exfiltration via Shared Rep - CVE-2026-41177
Squidex has Blind SSRF via file:// Protocol in Restore API l
V. Comments for CVE-2025-66257
No comments yet