CVE-2025-10368

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-10368

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10368.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-10368

Published

2025-09-13T15:32:05Z

Modified

2026-08-12T03:51:49Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

MiczFlor RPi-Jukebox-RFID manageFilesFolders.php cross site scripting

Details

A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/manageFilesFolders.php. Performing manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10368.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.0"
                },
                {
                    "last_affected": "2.0"
                },
                {
                    "introduced": "2.1"
                },
                {
                    "last_affected": "2.1"
                },
                {
                    "introduced": "2.2"
                },
                {
                    "last_affected": "2.2"
                },
                {
                    "introduced": "2.3"
                },
                {
                    "last_affected": "2.3"
                },
                {
                    "introduced": "2.4"
                },
                {
                    "last_affected": "2.4"
                },
                {
                    "introduced": "2.5"
                },
                {
                    "last_affected": "2.5"
                },
                {
                    "introduced": "2.6"
                },
                {
                    "last_affected": "2.6"
                },
                {
                    "introduced": "2.7"
                },
                {
                    "last_affected": "2.7"
                },
                {
                    "introduced": "2.8.0"
                },
                {
                    "last_affected": "2.8.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/miczflor/rpi-jukebox-rfid

Affected ranges

Type

GIT

Repo

https://github.com/miczflor/rpi-jukebox-rfid

Events

Introduced

Last Affected

5044358f412b97426187d2dfc3fb985c27233107

Database specific

Show details

{
    "cpe": "cpe:2.3:a:sourcefabric:rpi-jukebox-rfid:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.0"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

0.*

0.9.1

V2.*

V2.3.0

V2.4.0

v0.*

v0.9

v0.9.2

v0.9.3

v0.9.4

v0.9.5

v0.9.6

v0.9.7

Other

v1.*

v1.0.0

v1.1.1

v1.1.2

v1.1.3

v1.1.4

v1.1.6

v1.1.7

v1.1.8

v1.1.9

v2.*

v2.0.0

v2.1.0

v2.1.1

v2.2.0

v2.5.0

v2.6.0

v2.7.0

v2.8.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-10368.json"