CVE-2025-14722

Vulnerability

Description

CVE-2025-14722 is a cross-site scripting (XSS) vulnerability found in the vion707 DMadmin project up to commit 3403cafdb42537a648c30bf8cbc8148ec60437d1. The flaw resides in the Add function within Admin/Controller/AddonsController.class.php of the backend component. The root cause is insufficient sanitization of user-supplied input, allowing an attacker to inject malicious scripts. The vendor did not respond to disclosure attempts.

Exploitation

Details

The attack can be carried out remotely without requiring advanced privileges. Since the affected component is part of the backend administrative interface, an attacker would need to trick an authenticated administrator into visiting a crafted URL or interacting with a malicious payload. The exploit has been publicly disclosed, increasing the risk of active use [1].

Impact

Successful exploitation could allow an attacker to execute arbitrary JavaScript in the context of the victim's session. This could lead to session hijacking, defacement, or theft of sensitive data within the administrative panel. The CVSS v3 base score is 2.4 (Low), reflecting the requirement for user interaction and the limited direct impact.

Mitigation

Status

As the project follows a rolling release model, no specific patched version is available. The only mitigation is to avoid using the product or to restrict access to the administrative interface while applying input validation and output encoding manually [1].