Platform
php
Component
zzz
Fixed in
3403.0.1
CVE-2025-14722 describes a cross-site scripting (XSS) vulnerability discovered in vion707 DMadmin, affecting versions up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. Successful exploitation allows an attacker to inject malicious scripts into the application, potentially compromising user sessions and data. A fix is available in version 3403.0.1.
This XSS vulnerability allows an attacker to inject arbitrary JavaScript code into the DMadmin interface. An attacker could leverage this to steal user credentials, redirect users to malicious websites, or deface the application. The impact is amplified if DMadmin is used to manage sensitive data or control critical infrastructure, as an attacker could potentially gain unauthorized access and control. The publicly disclosed nature of the exploit increases the likelihood of exploitation, especially given the vendor's lack of response to the disclosure.
This vulnerability has been publicly disclosed, increasing the risk of exploitation. While the CVSS score is LOW (2.4), the public availability of the exploit makes it a significant concern. The vendor's lack of response to the disclosure further exacerbates the risk, suggesting that a patch may not be prioritized. There is no indication of this being added to the CISA KEV catalog or active exploitation campaigns at this time.
Exploit Status
EPSS
0.04% (11% percentile)
CISA SSVC
CVSS Vector
The primary mitigation is to upgrade to version 3403.0.1 or later, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider implementing temporary workarounds such as input validation and output encoding on the Add function within Admin/Controller/AddonsController.class.php. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the Add function and verifying that it is properly sanitized.
Update DMadmin to a version later than 3403cafdb42537a648c30bf8cbc8148ec60437d1. If no updates are available, review and sanitize user inputs in the file Admin/Controller/AddonsController.class.php, Add function, to prevent malicious code injection.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-14722 is a cross-site scripting (XSS) vulnerability in vion707 DMadmin versions up to 3403cafdb42537a648c30bf8cbc8148ec60437d1, allowing attackers to inject malicious scripts.
You are affected if you are using vion707 DMadmin versions prior to 3403.0.1. Check your version and upgrade if necessary.
Upgrade to version 3403.0.1 or later. As a temporary workaround, implement input validation and output encoding.
While there's no confirmed active exploitation, the vulnerability is publicly disclosed, increasing the risk of exploitation.
Due to the vendor's lack of response, an official advisory may not be available. Monitor security news sources for updates.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.