CVE-2025-45236

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-05-05 · updated 2026-07-05
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Nickname parameter.

Affected products

Dbsyncer Project Dbsyncer: 2.0.6

References

https://gist.github.com/chao112122/504e224e63c9a966ba233df1d523ce4f
https://github.com/86dbs/dbsyncer

Get alerted when CVE-2025-45236 or the next vulnerability affects your stack