CVE-2025-66723

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

nMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths.

References

Link	Resource
https://github.com/audiopump/cve-2025-66723	Exploit Third Party Advisory
https://www.inmusicbrands.com/	Product

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:inmusicbrands:engine_dj_desktop:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

05 Jan 2026, 20:25

Type	Values Removed	Values Added
First Time		Apple macos Inmusicbrands Inmusicbrands engine Dj Desktop Microsoft windows Apple Microsoft
CPE		cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:inmusicbrands:engine_dj_desktop:::::::: cpe:2.3:o:apple:macos:-:::::::*
References	~~() https://github.com/audiopump/cve-2025-66723 -~~	() https://github.com/audiopump/cve-2025-66723 - Exploit, Third Party Advisory
References	~~() https://www.inmusicbrands.com/ -~~	() https://www.inmusicbrands.com/ - Product

05 Jan 2026, 17:15

Type	Values Removed	Values Added
References	~~{'url': 'http://inmusic.com', 'source': '[email protected]'}~~	() https://www.inmusicbrands.com/ -
Summary	~~(en) inMusic Brands Engine DJ 4.3.0 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths.~~	(en) inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all files and network paths.