CVE-2025-66263

Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download_setting.php allows reading arbitrary files. The `/var/tdf/download_setting.php` endpoint constructs file paths by concatenating user-controlled `$_GET['filename']` with a forced `.tgz` extension. Running on PHP 5.3.2 (pre-5.3.4), the application is vulnerable to null byte injection (%00), allowing attackers to bypass the extension restriction and traverse paths. By requesting `filename=../../../../etc/passwd%00`, the underlying C functions treat the null byte as a string terminator, ignoring the appended `.tgz` and enabling unauthenticated arbitrary file disclosure of any file readable by the web server user.

• CWE-158

• https://www.abdulmhsblog.com/posts/webfmvulns/Exploit, Third Party Advisory

Published

Nov 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66258Stored Cross-Site Scripting via XML Injection in DB Electron…5.4
• CVE-2025-66259Authenticated Root Remote Code Execution via improrer user i…9.8
• CVE-2025-6626The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Opti…4.4
• CVE-2025-66260PostgreSQL SQL Injection (status_sql.php) in DB Electronica …6.5
• CVE-2025-66261Unauthenticated OS Command Injection (restore_settings.php) …9.8
• CVE-2025-66262Arbitrary File Overwrite via Tar Extraction Path Traversal i…9.8
• CVE-2025-66264The CMService.exe service runs with SYSTEM privileges and co…7.2
• CVE-2025-66265CMService.exe creates the C:\\usr directory and subdirectori…6.9
• CVE-2025-66266The RupsMon.exe service executable in UPSilon 2000 has insec…9.3
• CVE-2025-66269The RupsMon and USBMate services in UPSilon 2000 run with SY…7.1
• CVE-2025-6627A vulnerability has been found in TOTOLINK A702R 4.0.0-B2023…8.8
• CVE-2025-66270The KDE Connect protocol 8 before 2025-11-28 does not correl…4.7