CVE-2025-65229CWE-79cross-site-scripting

CVE-2025-65229

Medium · published December 9, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
5.9
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with access to Settings Player can save arbitrary HTML/JavaScript in the Player name field. That value is stored by the server and later rendered without proper output encoding on the Information (Player Info) tab, causing the script to execute in the context of any user viewing that page.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00168 · 5.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-09T01:15Z
Affected products (1)
ProductVersionsFixed in
lyrion/lyrion_music_server≤ 9.0.3—
References (2)
https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65229 · [email protected]https://lyrion.org/ · [email protected]
EPSS history
Timeline
  • 08 DEC 00:00Z
    A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3
    cvelistv5