Medium · 6.1 CVE-2025-63211 EUVD-2025-198177GHSA-5356-vf3g-3c6h

Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attac…

Published Nov 19, 2025 · Updated Nov 21, 2025 · Assigned by mitre

Description

Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackers to execute arbitrary code via the addName parameter to the /vbc/core/userSetupDoc/userSetupDoc endpoint.

References

https://bridgetech.tv/
https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-63211_bridgetech%20VBC%20Server%20and%20Element%20Manager%20Stored%20%20xss