CVE-2025-46729: phpDVDProfiler Cross-site Scripting vulnerability
First published: Mon May 12 2025(Updated: )
julmud/phpDVDProfiler is an adoption of the defunct phpDVDProfiler project, which allows users to display on the web their DVD collections maintained with Invelos's DVDProfiler software. Starting in v_20230807 and prior to v_20250511, cross-site scripting in the search function. v_20250511 contains a patch for the issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| phpDVDProfiler | >=v_20230807<v_20250511 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/julmud/phpDVDProfiler/security/advisories/GHSA-x3rx-6c2m-6vg9
- https://github.com/julmud/phpDVDProfiler/commit/c97e4b577969d5f6ca8171333b362fcdbec838a7
- https://github.com/julmud/phpDVDProfiler/releases/tag/v_20250511
- https://www.openbugbounty.org/reports/3456782
- https://www.openbugbounty.org/reports/3512265
Frequently Asked Questions
What is the severity of CVE-2025-46729?
CVE-2025-46729 is classified as a cross-site scripting (XSS) vulnerability, which can allow attackers to inject malicious scripts.
How do I fix CVE-2025-46729?
To mitigate CVE-2025-46729, upgrade phpDVDProfiler to version v_20250511 or later.
What versions of phpDVDProfiler are affected by CVE-2025-46729?
CVE-2025-46729 affects phpDVDProfiler versions from v_20230807 to v_20250511.
How does CVE-2025-46729 exploit the search function?
CVE-2025-46729 exploits the search function by allowing crafted input to inject and execute unauthorized JavaScript in the user's browser.
Is there a workaround for CVE-2025-46729 if I cannot upgrade?
If an upgrade is not possible, a potential workaround is to sanitize and validate all input to the search function to prevent script injection.
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/julmud
- canonical/phpdvdprofiler