CVE-2025-65231

MediumCVSS 6.1/10Last modified Oct 14, 2026

Description

Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically the CTS close command user-input field which is stored and later rendered on the Status page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65231Exploit, Third Party Advisory
https://help.barix.com/instreamer/user-manualProduct
https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65231Exploit, Third Party Advisory

Timeline

Published: Dec 8, 2025
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-652336.1Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysco CVE-2025-652359.8OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in CVE-2025-652369.8OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occ CVE-2025-652376.1A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary Jav CVE-2025-652386.5Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attacke CVE-2025-652394.3Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers CVE-2025-65243.1A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video Ser CVE-2025-65254.3A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin CVE-2025-65265.3A vulnerability, which was classified as problematic, has been found in 70mai M300 up to 20250611. This issue affects some unknown processin CVE-2025-652645.5The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attack CVE-2025-652679.0In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers to embed malicious Jav CVE-2025-65273.1A vulnerability, which was classified as problematic, was found in 70mai M300 up to 20250611. Affected is an unknown function of the compone