{"metadata": {"vulnerability": "CVE-2025-63607", "count": 13, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 8}}, "data": [{"timestamp": "2025-10-27T00:00:00Z", "date_only": false, "value": "2025-10-27T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2025-63607", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-28T22:31:17.253Z", "date_only": false, "value": "2026-08-28T22:31:17.253203Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583", "record": "CVE-2025-63607", "field": "creation_timestamp", "uuid": "bfcc77e1-0e15-4e35-a558-4048b1ccfd26", "content": "# Reflected Cross-Site Scripting (XSS) in TechStore \u2014 CVE-2025-63607\n\n**Discoverer:** Mohammed ElKhateb (HoRRus)\n**CVE ID:** CVE-2025-63607 *(MITRE-reserved at time of writing)*\n**CWE:** [CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n**Affected Product:** [nooncarlett/TechStore](https://github.com/nooncarlett/TechStore) v1.0\n**Affected Component:** `contact_display` request handler\n\n---\n\n## Summary\n\nThe `TechStore` web application (v1.0) contains a reflected Cross-Site Scripting (XSS) vulnerability in its `contact_display` endpoint. The application echoes the `id` query parameter verbatim into the rendered HTML response without any output encoding or server-side validation, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session.\n\n## Vulnerability Details\n\nThe `contact_display` handler builds its HTML response by directly interpolating the value of the `id` GET parameter into the page without escaping it for the HTML context. Because there is no whitelist validation (e.g., enforcing a numeric-only `id`) and no HTML-context output encoding, any HTML/JavaScript markup supplied in `id` is reflected back and rendered by the browser as part of the page.\n\n**Vulnerable parameter:** `id` (GET)\n**Sink:** Unescaped interpolation into the HTML response body\n\n## Proof of Concept\n\n1. Clone the repository locally:\n   ```\n   git clone https://github.com/nooncarlett/TechStore\n   ```\n2. Install the project's requirements as documented in the repository.\n3. Run the application:\n   ```\n   python app.py\n   ```\n4. In a browser, navigate to:\n   ```\n   http://127.0.0.1:5001/contact_display?id=1alert('XSS POPUP')\n   ```\n5. The injected `` executes and the `alert('XSS POPUP')` dialog fires, confirming the reflected XSS.\n\n## Attack Scenario\n\nBecause the payload is delivered entirely via a GET request, an attacker can weaponize it as a simple link:\n\n```\nhttp:///contact_display?id=1...attacker JS...\n```\n\nThis link can be distributed via phishing email, chat, or social media. When a victim who is logged into the application opens the link, the attacker's script executes in the victim's browser session, with the same access as the victim \u2014 enabling session/cookie theft, unauthorized actions performed as the victim, or delivery of further malicious payloads (e.g., redirects, credential-harvesting overlays).\n\n## Impact\n\n- **Confidentiality:** Disclosure of session tokens / sensitive in-page data reachable by script.\n- **Integrity:** Ability to perform actions as the authenticated victim (e.g., form submissions) via injected script.\n- **Availability:** Not directly impacted.\n\n**Suggested CVSS v3.1 vector (self-assessed):**\n`AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` \u2014 **Base Score: 6.1 (Medium)**\n\n*(Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality: Low, Integrity: Low, Availability: None)*\n\n## Remediation\n\n- Apply context-aware output encoding to any user-controllable value rendered into HTML (e.g., HTML-entity encode `id` before interpolation).\n- Validate/whitelist the `id` parameter server-side (e.g., enforce it is numeric before use).\n- Deploy a restrictive Content-Security-Policy (CSP) to reduce the impact of any residual injection points (e.g., disallow inline `` execution).\n\n## Disclosure Timeline\n\n- Vulnerability discovered and reported to MITRE's CVE Assignment Team (CNA of Last Resort) for the affected open-source project.\n- CVE-2025-63607 reserved and confirmed via official MITRE assignment email.\n- Public write-up published by the discoverer to support record publication.\n\n## References\n\n- [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n- [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n- [MDN: Cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Web/Security/Cross-site_scripting_(XSS))\n- [Affected repository: nooncarlett/TechStore](https://github.com/nooncarlett/TechStore)\n- [CVE Record (pending publication): CVE-2025-63607](https://www.cve.org/CVERecord?id=CVE-2025-63607)\n\n---\n\n*Reported and documented by Mohammed ElKhateb ([HoRRus](https://horrus-offsec.com/)) \u2014 [LinkedIn](https://www.linkedin.com/in/mohammed-elkhateb-horrus) \u00b7 [Hack The Box](https://app.hackthebox.com/users/1506676)*\n", "url": "https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583"}, {"timestamp": "2026-08-31T00:00:00Z", "date_only": false, "value": "2026-08-31T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-63607", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-31T20:30:29.806Z", "date_only": false, "value": "2026-08-31T20:30:29.806Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "CVE-2025-63607", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-31T21:17:06Z", "date_only": false, "value": "2026-08-31T21:17:06Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J8WF-QXGQ-3C7M", "record": "GHSA-J8WF-QXGQ-3C7M", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-08-31T21:17:06.210Z", "date_only": false, "value": "2026-08-31T21:17:06.210", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-63607", "record": "FKIE_CVE-2025-63607", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-31T21:32:11Z", "date_only": false, "value": "2026-08-31T21:32:11Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J8WF-QXGQ-3C7M", "record": "GHSA-J8WF-QXGQ-3C7M", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-01T14:08:32.431Z", "date_only": false, "value": "2026-09-01T14:08:32.431041Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-63607", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-09-01T14:08:32.431Z", "date_only": false, "value": "2026-09-01T14:08:32.431041Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-63607", "record": "FKIE_CVE-2025-63607", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-01T14:08:39.940Z", "date_only": false, "value": "2026-09-01T14:08:39.940Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2025-63607", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-01T14:08:39.940Z", "date_only": false, "value": "2026-09-01T14:08:39.940Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2025-63607", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-01T15:31:01Z", "date_only": false, "value": "2026-09-01T15:31:01Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J8WF-QXGQ-3C7M", "record": "GHSA-J8WF-QXGQ-3C7M", "field": "modified"}, {"timestamp": "2026-10-26T21:10:00.170Z", "date_only": false, "value": "2026-10-26T21:10:00.170", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2025-63607", "record": "FKIE_CVE-2025-63607", "field": "lastModified"}], "metrics": {"as_of": "2026-11-03T05:47:36.844Z", "anchors": {"origin": {"timestamp": "2026-08-31T00:00:00Z", "date_only": false, "value": "2026-08-31T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-63607", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-31T00:00:00Z", "date_only": false, "value": "2026-08-31T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-63607", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 5550456.844932, "hours": 1541.7935680366668, "days": 64.24139866819445, "min_seconds": 5464056.844932, "max_seconds": 5550456.844932, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-31T00:00:00Z", "date_only": false, "value": "2026-08-31T00:00:00.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2025-63607", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-03T05:47:36.844Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}