EUVD-2025-210901
GHSA-2xp8-xg4h-rrr9
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Authenticated stored XSS requiring victim interaction; scope changed as other users' sessions are impacted; no availability loss.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field.
AnalysisAI
Stored Cross-Site Scripting in the web backend of Repetico 1.9.7.31 for Android allows an authenticated remote user to inject and execute arbitrary JavaScript in other users' app contexts by embedding a malicious payload in a multiple-choice question text field. The CVSS Scope:Changed metric confirms the injected script can affect victim users beyond the attacker's own session, enabling session hijacking, credential theft, or unauthorized in-app actions. A researcher-published PoC writeup on GitHub confirms the attack path. No vendor patch or advisory has been identified at this time.
Technical ContextAI
Repetico is a mobile flashcard and learning application for Android whose core functionality is backed by a web-based content service. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: user-supplied text entered in the multiple-choice question authoring field is rendered back to other users without adequate output encoding or content-security policy enforcement. Because the rendering occurs in the app's WebView or equivalent web-backend context, injected scripts execute with the privileges of the app's web session. The Scope:Changed (S:C) designation in the CVSS vector reflects that the exploit crosses session boundaries from the attacker to innocent users who subsequently view the crafted question content.
RemediationAI
No vendor-released patch has been identified at time of analysis. The sole reference is a researcher's PoC writeup at https://github.com/ciernyvlk/CVE/blob/main/CVE-2025-63842.md; no Repetico vendor advisory, release notes, or patched version number has been published. Until an official fix is available, administrators and operators should restrict who can create or edit question content within the platform, preventing untrusted users from authoring multiple-choice questions. Deploying a strict Content Security Policy (CSP) on the web backend to block inline script execution would mitigate the XSS vector without disabling content authoring, though this requires backend access. Users should be advised to avoid opening or previewing question sets from untrusted authors pending a vendor update.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today