A stored cross-site scripting (XSS) vulnerability in the Edit Profile feature of DBSyncer v2.0.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Nickname parameter.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| http://dbsyncer.com | Product |
| https://gist.github.com/chao112122/504e224e63c9a966ba233df1d523ce4f | Third Party Advisory Exploit |
| https://github.com/86dbs/dbsyncer | Product |
Configurations
History
16 Jun 2025, 20:36
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
86dbs dbsyncer
86dbs |
|
| CPE | cpe:2.3:a:86dbs:dbsyncer:2.0.6:*:*:*:*:*:*:* | |
| References | () https://gist.github.com/chao112122/504e224e63c9a966ba233df1d523ce4f - Third Party Advisory, Exploit | |
| References | () http://dbsyncer.com - Product | |
| References | () https://github.com/86dbs/dbsyncer - Product |
05 May 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-05 18:15
Updated : 2025-06-16 20:36
NVD link : CVE-2025-45236
Mitre link : CVE-2025-45236
JSON object : View
Products Affected
86dbs
- dbsyncer
CWE
No CWE.