CVE-2025-10945

A cross-site scripting (XSS) vulnerability has been discovered in nuz007's smsboom up to commit 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. The issue resides in the file d.php, where the hm parameter is not properly sanitized before being processed, leading to injection of arbitrary HTML and JavaScript code [1].

Attackers can exploit this vulnerability remotely without authentication by crafting a malicious URL that passes a crafted hm value. The product is a SMS bombing tool often used for testing or malicious purposes, so the attacker may trick a user into clicking a crafted link, triggering the XSS in the victim's browser.

Successful exploitation allows the attacker to execute arbitrary scripts in the context of the vulnerable application. This can lead to session hijacking, cookie theft, or redirection to malicious sites, depending on the application's functionality and the attacker's payload.

As smsboom is a rolling release project with no fixed version numbers, users are advised to update to the latest commit available on the official repository. No other mitigations are documented at this time [1].