CVE-2025-61583

TS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handling

CVSS 4.3 MEDIUMEPSS 0.2%CWE-20 CWE-80

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 4.3EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

01 Oct 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. A reflected cross-site scripting vulnerability has been identified in versions 2.2.1 and earlier. The vulnerability exists in the error handling mechanism of the login page, where malicious scripts embedded in server hostnames are executed in the victim's browser context without proper sanitization. This issue is fixed in version 2.2.2.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Affected products

joni1802 · ts3-manager

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/joni1802/ts3-manager/commit/3a069915f97a6f5dae1fe0b2e32aa11a69d83b5e https://github.com/joni1802/ts3-manager/security/advisories/GHSA-qw6j-37r6-m93g