https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-66263.htmlhttps://patchthecve.com/cve/CVE-2025-66263.htmlMon, 19 Oct 2026 13:10:00 +0000HIGH 7.5: Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download_setting.php allows reading arbitrary files. Thhttps://patchthecve.com/cve/CVE-2025-66258.htmlhttps://patchthecve.com/cve/CVE-2025-66258.htmlWed, 17 Jun 2026 09:56:34 +0000MEDIUM 5.4: Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Stored XSS via crafted filenames injected into patchlist.xml. User-controlled filenames are https://patchthecve.com/cve/CVE-2025-66255.htmlhttps://patchthecve.com/cve/CVE-2025-66255.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.8: Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation allows uploading malicious firmware packages.  T