CVE-2025-2354

Name of the Vulnerable Software and Affected Versions VAM Virtual Airlines Manager version 2.6.2

Description A vulnerability has been found in VAM Virtual Airlines Manager, affecting an unknown functionality of the file /vam/index.php. The manipulation of the argument registry id/plane icao/hub id leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For version 2.6.2, as a temporary workaround, consider restricting access to the /vam/index.php file until a patch is available. Avoid using the argument registry id/plane icao/hub id in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.