CVE-2025-65229

A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with access to Settings Player can save arbitrary HTML/JavaScript in the Player name field. That value is stored by the server and later rendered without proper output encoding on the Information (Player Info) tab, causing the script to execute in the context of any user viewing that page.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65229
https://lyrion.org/	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:lyrion:lyrion_music_server:*:*:*:*:*:*:*:*

History

18 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en la interfaz web de Lyrion Music Server menor o igual que 9.0.3. Un usuario autenticado con acceso a Ajustes del Reproductor puede guardar HTML/JavaScript arbitrario en el campo de nombre del reproductor. Ese valor es almacenado por el servidor y posteriormente renderizado sin la codificación de salida adecuada en la pestaña Información (Información del Reproductor), causando que el script se ejecute en el contexto de cualquier usuario que vea esa página.

Information

Published : 2025-12-08 20:15

Updated : 2026-10-18 15:10

NVD link : CVE-2025-65229

Mitre link : CVE-2025-65229

CVE.ORG link : CVE-2025-65229

JSON object : View

Products Affected

lyrion

lyrion_music_server

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-65229", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65229", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-08T21:21:32.800538Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.1}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-08T20:15:52.857", "references": [{"url": "https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65229", "source": "cve@mitre.org"}, {"url": "https://lyrion.org/", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with access to Settings Player can save arbitrary HTML/JavaScript in the Player name field. That value is stored by the server and later rendered without proper output encoding on the Information (Player Info) tab, causing the script to execute in the context of any user viewing that page."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en la interfaz web de Lyrion Music Server menor o igual que 9.0.3. Un usuario autenticado con acceso a Ajustes del Reproductor puede guardar HTML/JavaScript arbitrario en el campo de nombre del reproductor. Ese valor es almacenado por el servidor y posteriormente renderizado sin la codificaci\u00f3n de salida adecuada en la pesta\u00f1a Informaci\u00f3n (Informaci\u00f3n del Reproductor), causando que el script se ejecute en el contexto de cualquier usuario que vea esa p\u00e1gina."}], "lastModified": "2026-10-18T15:10:00.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lyrion:lyrion_music_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E8A1EEF2-859C-4C9B-9DC1-CAB4930CE371", "versionEndIncluding": "9.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}