EUVD-2025-210815
GHSA-j8wf-qxgq-3c7m
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-reachable reflected XSS requires no auth (PR:N) but needs victim interaction (UI:R); scope changes to victim browser (S:C) with limited confidentiality/integrity impact and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.
AnalysisAI
Reflected XSS in TechStore 1.0 contact_display endpoint allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by embedding a malicious payload in the id URL parameter, which the application echoes verbatim into the rendered HTML. The CVSS Scope:Changed metric confirms cross-origin browser-level impact, enabling session theft, credential harvesting, or DOM manipulation against any user who clicks a crafted link. No active exploitation is confirmed via CISA KEV; a public proof-of-concept exists on GitHub at the referenced gist, and EPSS at 0.16% (6th percentile) reflects low current exploitation activity.
Technical ContextAI
TechStore 1.0 is a web application exposing a contact_display view that fails to apply output encoding to the id URL parameter before inserting its value into the HTML response. This is a classic reflected (non-persistent) XSS instance, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Because the injected script executes within the victim browser's session context for the TechStore origin, it has access to cookies, local storage, and the DOM - consistent with the CVSS S:C (Scope Changed) designation. The CPE entry in the input uses placeholder 'n/a' vendor and product fields and does not accurately represent TechStore; affected versions beyond 1.0 are not documented in available intelligence.
RemediationAI
The primary fix is to apply context-appropriate HTML output encoding to the id parameter value at render time in the contact_display view - for example, using htmlspecialchars() with ENT_QUOTES in PHP, or the equivalent escaping function for the application's framework, before inserting user-supplied input into HTML context. Operators should additionally implement a restrictive Content Security Policy (CSP) response header (e.g., script-src 'self') as defense-in-depth to limit inline script execution; note that CSP alone does not eliminate the XSS but significantly reduces its impact. As a short-term compensating control, deploying a WAF rule to detect and block XSS payloads in the id parameter is actionable, though it introduces latency and may produce false positives on legitimate inputs containing special characters. No vendor-released patched version has been identified from available data. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-63607.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today