{"id":"CVE-2025-65228","aliases":["EUVD-2025-201811","GHSA-xx7c-xcq4-cj23"],"status":"published","title":"A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R....","description":"A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799).","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00231,"percentile":0.14038,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-12-08T00:00:00Z","modified":"2026-10-18T16:10:00Z","products":[{"vendor":"rvr","product":"tlk302t_firmware"}],"references":[{"url":"https://www.rvr.it/en/products/components/telemetry-units-system/tlk300-series/tlk302t/","tags":["Product"]},{"url":"https://github.com/iyadalkhatib98/My_CVES/tree/main/CVE-2025-65228","tags":["Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65228"},{"url":"https://www.rvr.it/en/products/components/telemetry-units-system/tlk300-series/tlk302t"},{"url":"https://github.com/advisories/GHSA-xx7c-xcq4-cj23"}],"sources":{"cve":[{"id":"CVE-2025-65228","description":"A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799).","status":"published","published":"2025-12-08T00:00:00Z","modified":"2025-12-08T21:20:45.921Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:26.64278Z"}],"euvd":[{"id":"EUVD-2025-201811","description":"A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799).","status":"published","published":"2025-12-08T00:00:00Z","modified":"2025-12-08T21:20:45Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:49:08.541096Z"}],"ghsa":[{"id":"GHSA-xx7c-xcq4-cj23","title":"A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R....","description":"A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799).","status":"published","published":"2025-12-08T21:30:22Z","modified":"2025-12-09T00:32:19Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:05:05.976411Z"}],"nvd":[{"id":"CVE-2025-65228","description":"A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799).","status":"published","published":"2025-12-08T21:16:03.467Z","modified":"2026-10-18T16:10:00.1Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:49.093461Z"}]}}