CVE-2025-10946
Last modified
CVE-2025-10946 is a medium-severity vulnerability rated 5.1/10 on the CVSS scale. A vulnerability was detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. The affected element is an unknown function of the file dy.php. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A vulnerability was detected in nuz007 smsboom up to 01b2f35bbbc23f3e0f60f38ca0e3d1b286f8d674. The affected element is an unknown function of the file dy.php. Performing manipulation of the argument hm results in cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-10946?
How severe is CVE-2025-10946?
How do I fix CVE-2025-10946?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-10940A vulnerability was found in Total.js CMS 1.0.0. Affected by…4.8
- CVE-2025-10941A vulnerability was determined in Topaz SERVCore Teller 2.14…8.5
- CVE-2025-10942A vulnerability was identified in H3C Magic B3 up to 100R002…8.8
- CVE-2025-10943A security flaw has been discovered in MikeCen WeChat-Face-R…5.1
- CVE-2025-10944A weakness has been identified in yi-ge get-header-ip up to …5.1
- CVE-2025-10945A security vulnerability has been detected in nuz007 smsboom…5.1
- CVE-2025-10947A flaw has been found in Sistemas Pleno Gestão de Locação up…5.5
- CVE-2025-10948A vulnerability has been found in MikroTik RouterOS 7. This …8.8
- CVE-2025-10949A vulnerability was found in Changsha Developer Technology i…2.4
- CVE-2025-1095IBM Personal Communications v14 and v15 include a Windows se…7.8
- CVE-2025-10950A vulnerability was determined in geyang ml-logger up to acf…6.3
- CVE-2025-10951A vulnerability was identified in geyang ml-logger up to acf…7.3
Are you affected by CVE-2025-10946?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST