https://vulnerability.circl.lu/sightings/feed 2026-09-17T09:59:07.750086+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/b20e1f8c-beb6-40bb-8eaa-ba5acf5017b4/export 2026-09-17T09:59:07.762660+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "b20e1f8c-beb6-40bb-8eaa-ba5acf5017b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63458", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/2120", "content": "\u2728 General Cyber News \u2728\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 Tenda AX1803: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\n\u2014\n\nSummary:\n\u0412 \u043a\u043e\u043d\u0446\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044f 2025 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 Tenda AX1803. \u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0441\u0442\u0435\u043a\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 form_fast_setting_wifi_set(), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043e\u0442\u043a\u0430\u0437\u0443 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0443\u0436\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u043b\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2025-63458 \u044d\u0442\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435, \u0447\u0442\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u0435\u0435 \u0437\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 1.0.0.1 \u0438 [\u2026]\n\u0421\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f...\n\n\u2014\n\nSource: \u0410\u0440\u0445\u0438\u0432\u044b \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 - SEC-1275-1\nPublished: 2025-11-10 05:50 | Author: Vulner Queen\n\n#ax1803 #tenda #general_cyber_news\n\nhttps://1275.ru/vulnerability/kriticheskaya-uyazvimost-v-marshrutizatorah-tenda-ax1803-ugroza-perepolneniya-bufera-i-otkaza-v-obsluzhivanii_16130", "creation_timestamp": "2026-09-10T00:00:37.028183Z"} 2026-09-10T00:00:37.028183+00:00 https://vulnerability.circl.lu/sighting/a7679449-fe7b-492a-9381-3da0277906c0/export 2026-09-17T09:59:07.764105+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a7679449-fe7b-492a-9381-3da0277906c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63458", "type": "seen", "source": "https://t.me/Intel_Encyclopedia/2120", "content": "\u2728 General Cyber News \u2728\n\n\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 Tenda AX1803: \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438\n\n\u2014\n\nSummary:\n\u0412 \u043a\u043e\u043d\u0446\u0435 \u043e\u043a\u0442\u044f\u0431\u0440\u044f 2025 \u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u0430\u0445 Tenda AX1803. \u0420\u0435\u0447\u044c \u0438\u0434\u0435\u0442 \u043e \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0441\u0442\u0435\u043a\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 form_fast_setting_wifi_set(), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u043e\u0442\u043a\u0430\u0437\u0443 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0443\u0436\u0435 \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u043b\u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2025-63458 \u044d\u0442\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435, \u0447\u0442\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u0435\u0435 \u0437\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0441\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0414\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 1.0.0.1 \u0438 [\u2026]\n\u0421\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f...\n\n\u2014\n\nSource: \u0410\u0440\u0445\u0438\u0432\u044b \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 - SEC-1275-1\nPublished: 2025-11-10 05:50 | Author: Vulner Queen\n\n#ax1803 #tenda #general_cyber_news\n\nhttps://1275.ru/vulnerability/kriticheskaya-uyazvimost-v-marshrutizatorah-tenda-ax1803-ugroza-perepolneniya-bufera-i-otkaza-v-obsluzhivanii_16130", "creation_timestamp": "2026-09-09T05:00:13.577741Z"} 2026-09-09T05:00:13.577741+00:00 https://vulnerability.circl.lu/sighting/74b71dce-fa3a-4074-bfdd-c4d2c9500d1a/export 2026-09-17T09:59:07.764259+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "74b71dce-fa3a-4074-bfdd-c4d2c9500d1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63416", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/173971", "content": "CVE-2025\u201363416: The Admin Panel Heist\u200a\u2014\u200aStored XSS to Privilege Escalation\nhttps://rohitchaudhary045.medium.com/cve-2025-63416-the-admin-panel-heist-stored-xss-to-privilege-escalation-b4c69d8487f1?source=rss------bug_bounty-5\n\nHow a Simple Chat Message Became a Backdoor to Administrative DominionContinue reading on Medium \u00bb (https://rohitchaudhary045.medium.com/cve-2025-63416-the-admin-panel-heist-stored-xss-to-privilege-escalation-b4c69d8487f1?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-04T00:01:04.442095Z"} 2026-09-04T00:01:04.442095+00:00 https://vulnerability.circl.lu/sighting/ee82f17f-8e93-420a-b1b4-0aadfa3d62c2/export 2026-09-17T09:59:07.764378+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ee82f17f-8e93-420a-b1b4-0aadfa3d62c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63416", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/173971", "content": "CVE-2025\u201363416: The Admin Panel Heist\u200a\u2014\u200aStored XSS to Privilege Escalation\nhttps://rohitchaudhary045.medium.com/cve-2025-63416-the-admin-panel-heist-stored-xss-to-privilege-escalation-b4c69d8487f1?source=rss------bug_bounty-5\n\nHow a Simple Chat Message Became a Backdoor to Administrative DominionContinue reading on Medium \u00bb (https://rohitchaudhary045.medium.com/cve-2025-63416-the-admin-panel-heist-stored-xss-to-privilege-escalation-b4c69d8487f1?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-03T03:00:06.643406Z"} 2026-09-03T03:00:06.643406+00:00 https://vulnerability.circl.lu/sighting/0d14de9b-4e5e-4357-a2b2-e6fd34fc7d3e/export 2026-09-17T09:59:07.764482+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "0d14de9b-4e5e-4357-a2b2-e6fd34fc7d3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63416", "type": "seen", "source": "https://t.me/hacking_Attack/173971", "content": "CVE-2025\u201363416: The Admin Panel Heist\u200a\u2014\u200aStored XSS to Privilege Escalation\nhttps://rohitchaudhary045.medium.com/cve-2025-63416-the-admin-panel-heist-stored-xss-to-privilege-escalation-b4c69d8487f1?source=rss------bug_bounty-5\n\nHow a Simple Chat Message Became a Backdoor to Administrative DominionContinue reading on Medium \u00bb (https://rohitchaudhary045.medium.com/cve-2025-63416-the-admin-panel-heist-stored-xss-to-privilege-escalation-b4c69d8487f1?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-02T01:00:33.954837Z"} 2026-09-02T01:00:33.954837+00:00 https://vulnerability.circl.lu/sighting/5dc5875d-c0a4-4e90-88cb-623d9633d2c2/export 2026-09-17T09:59:07.764595+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "5dc5875d-c0a4-4e90-88cb-623d9633d2c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63416", "type": "seen", "source": "https://t.me/hacking_Attack/173971", "content": "CVE-2025\u201363416: The Admin Panel Heist\u200a\u2014\u200aStored XSS to Privilege Escalation\nhttps://rohitchaudhary045.medium.com/cve-2025-63416-the-admin-panel-heist-stored-xss-to-privilege-escalation-b4c69d8487f1?source=rss------bug_bounty-5\n\nHow a Simple Chat Message Became a Backdoor to Administrative DominionContinue reading on Medium \u00bb (https://rohitchaudhary045.medium.com/cve-2025-63416-the-admin-panel-heist-stored-xss-to-privilege-escalation-b4c69d8487f1?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-01T20:00:17.375777Z"} 2026-09-01T20:00:17.375777+00:00 https://vulnerability.circl.lu/sighting/45b45ec8-3d76-408e-96cb-0c5f7dec4d4b/export 2026-09-17T09:59:07.764690+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "45b45ec8-3d76-408e-96cb-0c5f7dec4d4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63607", "type": "seen", "source": "https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583", "content": "# Reflected Cross-Site Scripting (XSS) in TechStore \u2014 CVE-2025-63607\n\n**Discoverer:** Mohammed ElKhateb (HoRRus)\n**CVE ID:** CVE-2025-63607 *(MITRE-reserved at time of writing)*\n**CWE:** [CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n**Affected Product:** [nooncarlett/TechStore](https://github.com/nooncarlett/TechStore) v1.0\n**Affected Component:** `contact_display` request handler\n\n---\n\n## Summary\n\nThe `TechStore` web application (v1.0) contains a reflected Cross-Site Scripting (XSS) vulnerability in its `contact_display` endpoint. The application echoes the `id` query parameter verbatim into the rendered HTML response without any output encoding or server-side validation, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session.\n\n## Vulnerability Details\n\nThe `contact_display` handler builds its HTML response by directly interpolating the value of the `id` GET parameter into the page without escaping it for the HTML context. Because there is no whitelist validation (e.g., enforcing a numeric-only `id`) and no HTML-context output encoding, any HTML/JavaScript markup supplied in `id` is reflected back and rendered by the browser as part of the page.\n\n**Vulnerable parameter:** `id` (GET)\n**Sink:** Unescaped interpolation into the HTML response body\n\n## Proof of Concept\n\n1. Clone the repository locally:\n ```\n git clone https://github.com/nooncarlett/TechStore\n ```\n2. Install the project's requirements as documented in the repository.\n3. Run the application:\n ```\n python app.py\n ```\n4. In a browser, navigate to:\n ```\n http://127.0.0.1:5001/contact_display?id=1alert('XSS POPUP')\n ```\n5. The injected `` executes and the `alert('XSS POPUP')` dialog fires, confirming the reflected XSS.\n\n## Attack Scenario\n\nBecause the payload is delivered entirely via a GET request, an attacker can weaponize it as a simple link:\n\n```\nhttp:///contact_display?id=1...attacker JS...\n```\n\nThis link can be distributed via phishing email, chat, or social media. When a victim who is logged into the application opens the link, the attacker's script executes in the victim's browser session, with the same access as the victim \u2014 enabling session/cookie theft, unauthorized actions performed as the victim, or delivery of further malicious payloads (e.g., redirects, credential-harvesting overlays).\n\n## Impact\n\n- **Confidentiality:** Disclosure of session tokens / sensitive in-page data reachable by script.\n- **Integrity:** Ability to perform actions as the authenticated victim (e.g., form submissions) via injected script.\n- **Availability:** Not directly impacted.\n\n**Suggested CVSS v3.1 vector (self-assessed):**\n`AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` \u2014 **Base Score: 6.1 (Medium)**\n\n*(Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality: Low, Integrity: Low, Availability: None)*\n\n## Remediation\n\n- Apply context-aware output encoding to any user-controllable value rendered into HTML (e.g., HTML-entity encode `id` before interpolation).\n- Validate/whitelist the `id` parameter server-side (e.g., enforce it is numeric before use).\n- Deploy a restrictive Content-Security-Policy (CSP) to reduce the impact of any residual injection points (e.g., disallow inline `` execution).\n\n## Disclosure Timeline\n\n- Vulnerability discovered and reported to MITRE's CVE Assignment Team (CNA of Last Resort) for the affected open-source project.\n- CVE-2025-63607 reserved and confirmed via official MITRE assignment email.\n- Public write-up published by the discoverer to support record publication.\n\n## References\n\n- [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n- [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n- [MDN: Cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Web/Security/Cross-site_scripting_(XSS))\n- [Affected repository: nooncarlett/TechStore](https://github.com/nooncarlett/TechStore)\n- [CVE Record (pending publication): CVE-2025-63607](https://www.cve.org/CVERecord?id=CVE-2025-63607)\n\n---\n\n*Reported and documented by Mohammed ElKhateb ([HoRRus](https://horrus-offsec.com/)) \u2014 [LinkedIn](https://www.linkedin.com/in/mohammed-elkhateb-horrus) \u00b7 [Hack The Box](https://app.hackthebox.com/users/1506676)*\n", "creation_timestamp": "2026-08-29T00:00:52.457294Z"} 2026-08-29T00:00:52.457294+00:00 https://vulnerability.circl.lu/sighting/bfcc77e1-0e15-4e35-a558-4048b1ccfd26/export 2026-09-17T09:59:07.764820+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bfcc77e1-0e15-4e35-a558-4048b1ccfd26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63607", "type": "seen", "source": "https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583", "content": "# Reflected Cross-Site Scripting (XSS) in TechStore \u2014 CVE-2025-63607\n\n**Discoverer:** Mohammed ElKhateb (HoRRus)\n**CVE ID:** CVE-2025-63607 *(MITRE-reserved at time of writing)*\n**CWE:** [CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n**Affected Product:** [nooncarlett/TechStore](https://github.com/nooncarlett/TechStore) v1.0\n**Affected Component:** `contact_display` request handler\n\n---\n\n## Summary\n\nThe `TechStore` web application (v1.0) contains a reflected Cross-Site Scripting (XSS) vulnerability in its `contact_display` endpoint. The application echoes the `id` query parameter verbatim into the rendered HTML response without any output encoding or server-side validation, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session.\n\n## Vulnerability Details\n\nThe `contact_display` handler builds its HTML response by directly interpolating the value of the `id` GET parameter into the page without escaping it for the HTML context. Because there is no whitelist validation (e.g., enforcing a numeric-only `id`) and no HTML-context output encoding, any HTML/JavaScript markup supplied in `id` is reflected back and rendered by the browser as part of the page.\n\n**Vulnerable parameter:** `id` (GET)\n**Sink:** Unescaped interpolation into the HTML response body\n\n## Proof of Concept\n\n1. Clone the repository locally:\n ```\n git clone https://github.com/nooncarlett/TechStore\n ```\n2. Install the project's requirements as documented in the repository.\n3. Run the application:\n ```\n python app.py\n ```\n4. In a browser, navigate to:\n ```\n http://127.0.0.1:5001/contact_display?id=1alert('XSS POPUP')\n ```\n5. The injected `` executes and the `alert('XSS POPUP')` dialog fires, confirming the reflected XSS.\n\n## Attack Scenario\n\nBecause the payload is delivered entirely via a GET request, an attacker can weaponize it as a simple link:\n\n```\nhttp:///contact_display?id=1...attacker JS...\n```\n\nThis link can be distributed via phishing email, chat, or social media. When a victim who is logged into the application opens the link, the attacker's script executes in the victim's browser session, with the same access as the victim \u2014 enabling session/cookie theft, unauthorized actions performed as the victim, or delivery of further malicious payloads (e.g., redirects, credential-harvesting overlays).\n\n## Impact\n\n- **Confidentiality:** Disclosure of session tokens / sensitive in-page data reachable by script.\n- **Integrity:** Ability to perform actions as the authenticated victim (e.g., form submissions) via injected script.\n- **Availability:** Not directly impacted.\n\n**Suggested CVSS v3.1 vector (self-assessed):**\n`AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` \u2014 **Base Score: 6.1 (Medium)**\n\n*(Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality: Low, Integrity: Low, Availability: None)*\n\n## Remediation\n\n- Apply context-aware output encoding to any user-controllable value rendered into HTML (e.g., HTML-entity encode `id` before interpolation).\n- Validate/whitelist the `id` parameter server-side (e.g., enforce it is numeric before use).\n- Deploy a restrictive Content-Security-Policy (CSP) to reduce the impact of any residual injection points (e.g., disallow inline `` execution).\n\n## Disclosure Timeline\n\n- Vulnerability discovered and reported to MITRE's CVE Assignment Team (CNA of Last Resort) for the affected open-source project.\n- CVE-2025-63607 reserved and confirmed via official MITRE assignment email.\n- Public write-up published by the discoverer to support record publication.\n\n## References\n\n- [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n- [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n- [MDN: Cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Web/Security/Cross-site_scripting_(XSS))\n- [Affected repository: nooncarlett/TechStore](https://github.com/nooncarlett/TechStore)\n- [CVE Record (pending publication): CVE-2025-63607](https://www.cve.org/CVERecord?id=CVE-2025-63607)\n\n---\n\n*Reported and documented by Mohammed ElKhateb ([HoRRus](https://horrus-offsec.com/)) \u2014 [LinkedIn](https://www.linkedin.com/in/mohammed-elkhateb-horrus) \u00b7 [Hack The Box](https://app.hackthebox.com/users/1506676)*\n", "creation_timestamp": "2026-08-28T22:31:17.253203Z"} 2026-08-28T22:31:17.253203+00:00 https://vulnerability.circl.lu/sighting/3bf450b8-7c38-45d9-8edb-8e29bfbf4321/export 2026-09-17T09:59:07.764947+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3bf450b8-7c38-45d9-8edb-8e29bfbf4321", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63353", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/429", "content": "CVE-2025-63353\n\nA vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe the SSID to predict the default password without authentication or user interaction.", "creation_timestamp": "2026-08-28T00:00:33.564957Z"} 2026-08-28T00:00:33.564957+00:00 https://vulnerability.circl.lu/sighting/92859cfd-c963-4a18-a9d5-7f7ef066f861/export 2026-09-17T09:59:07.765041+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "92859cfd-c963-4a18-a9d5-7f7ef066f861", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63353", "type": "seen", "source": "https://t.me/cve0day/429", "content": "CVE-2025-63353\n\nA vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an attacker who can observe the SSID to predict the default password without authentication or user interaction.", "creation_timestamp": "2026-08-27T15:00:06.933664Z"} 2026-08-27T15:00:06.933664+00:00