CVE-2025-6563

A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS executes. The POST request used to login, can also be converted to a GET request, allowing an attacker to send a specifically crafted URL that automatically logs in the victim (into the attacker's account) and triggers the payload.

• CWE-20

• https://www.toreon.com/how-a-ski-trip-led-to-a-cve-in-a-wi-fi-hotspot/
• https://www.toreon.com/how-a-ski-trip-led-to-a-cve-in-a-wi-fi-hotspot/

Published

Jul 3, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6560Multiple wireless router models from Sapido have an Exposure…9.8
• CVE-2025-65602A template injection vulnerability in the /vip/v1/file/save …9.8
• CVE-2025-6561Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hun…9.8
• CVE-2025-6562Certain hybrid DVR models (HBF-09KD and HBF-16NK) from Hunt …8.8
• CVE-2025-65621Snipe-IT before 8.3.4 allows stored XSS, allowing a low-priv…5.4
• CVE-2025-65622Snipe-IT before 8.3.4 allows stored XSS via the Locations "C…5.4
• CVE-2025-65637A denial-of-service vulnerability exists in github.com/sirup…7.5
• CVE-2025-65640Cross Site Scripting (XSS) vulnerability in the "Task in Pro…6.3
• CVE-2025-65647Insecure Direct Object Reference (IDOR) in the Track order f…4.3
• CVE-2025-6565A vulnerability was found in Netgear WNCE3001 1.0.0.50. It h…8.8
• CVE-2025-65656dcat-admin v2.2.3-beta and before is vulnerable to file incl…9.8
• CVE-2025-65657FeehiCMS version 2.1.1 has a Remote Code Execution via Unres…6.5