CVE-2025-57202

MediumCVSS 6.1/10Last modified Nov 4, 2026

Description

A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the username field.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/xchg-rax-rax/vulnerability-research/tree/main/CVE-2025-57202Exploit, Third Party Advisory

Timeline

Published: Dec 3, 2025
Last modified: Nov 4, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-572034.8MagicProject AI version 9.1 is affected by a Cross-Site Scripting (XSS) vulnerability within the chatbot generation feature available to aut CVE-2025-572045.4Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the CVE-2025-572055.4iNiLabs School Express (SMS Express) 6.2 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the content-management features CVE-2025-57215.4A vulnerability, which was classified as problematic, was found in SourceCodester Student Result Management System 1.0. This affects an unkn CVE-2025-572107.5Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unsp CVE-2025-572127.5Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a cra CVE-2025-572137.5Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a CVE-2025-572157.5Tenda AC10 v4.0 firmware v16.03.10.20 was discovered to contain a stack overflow via the function get_parentControl_list_Info.CVE-2025-572175.3Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter in the function R7We CVE-2025-572185.3Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parameter in the function s CVE-2025-572195.3Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attackers to escalate privi CVE-2025-57224.8A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as problematic. This vulnerability affe