Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows unauthenticated deletion of arbitrary files.
The `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks.
The `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.abdulmhsblog.com/posts/webfmvulns/ |
|
History
Wed, 26 Nov 2025 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows unauthenticated deletion of arbitrary files. The `deletepatch` parameter in `patch_contents.php` allows unauthenticated deletion of arbitrary files in `/var/www/patch/` directory without sanitization or access control checks. | |
| Title | Unauthenticated Arbitrary File Deletion (patch_contents.php) | |
| Weaknesses | CWE-73 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: Gridware
Published:
Updated: 2025-11-26T00:43:54.408Z
Reserved: 2025-11-26T00:21:33.791Z
Link: CVE-2025-66257
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-11-26T01:16:09.000
Modified: 2025-11-26T01:16:09.000
Link: CVE-2025-66257
Redhat
No data.
OpenCVE Enrichment
No data.