CVE-2025-63709

A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. The injected script is stored and later rendered in the browser of any user who views the task, allowing execution of arbitrary script in the context of the victim's browser.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/floccocam-cpu/CVE-Research-2025/tree/main/CVE-2025-63709	Exploit Mitigation Third Party Advisory
https://www.sourcecodester.com/php/17897/simple-do-list-system-using-php.html	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:chuck24:simple_to-do_list_system:1.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-11-10 15:15

Updated : 2025-12-01 20:15

NVD link : CVE-2025-63709

Mitre link : CVE-2025-63709

CVE.ORG link : CVE-2025-63709

JSON object : View

Products Affected

chuck24

simple_to-do_list_system

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-63709", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2025-11-10T15:15:37.793", "references": [{"url": "https://github.com/floccocam-cpu/CVE-Research-2025/tree/main/CVE-2025-63709", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.sourcecodester.com/php/17897/simple-do-list-system-using-php.html", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the \"Add Tasks\" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. The injected script is stored and later rendered in the browser of any user who views the task, allowing execution of arbitrary script in the context of the victim's browser."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) existe en SourceCodester Simple To-Do List System 1.0 en el campo de texto 'Add Tasks'. Un usuario autenticado puede enviar HTML/JavaScript que no se depura o codifica correctamente en la salida. El script inyectado se almacena y luego se renderiza en el navegador de cualquier usuario que vea la tarea, permitiendo la ejecuci\u00f3n de script arbitrario en el contexto del navegador de la v\u00edctima."}], "lastModified": "2025-12-01T20:15:54.240", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chuck24:simple_to-do_list_system:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "188CC7C5-CF9B-4488-B4DE-1B3547AFFDF2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}