CVE-2025-45236
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability was found in the Edit Profile feature of DBSyncer v2.0.6. Attackers can inject malicious HTML or JavaScript via the Nickname parameter, leading to script execution in other users' browsers.
Risk Assessment
The risk includes session hijacking, account takeover, or malware distribution within the organization. This can be exploited for social engineering attacks targeting administrators and IT staff.
Recommendation
Immediately update DBSyncer to the latest patched version. Until then, restrict access to the profile editing feature and implement input validation and sanitization for the Nickname parameter.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Nickname parameter.