https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 29 Aug 2026 01:57:37 +0000 https://vulnerability.circl.lu/sighting/45b45ec8-3d76-408e-96cb-0c5f7dec4d4b/export {"uuid": "45b45ec8-3d76-408e-96cb-0c5f7dec4d4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63607", "type": "seen", "source": "https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583", "content": "# Reflected Cross-Site Scripting (XSS) in TechStore \u2014 CVE-2025-63607\n\n**Discoverer:** Mohammed ElKhateb (HoRRus)\n**CVE ID:** CVE-2025-63607 *(MITRE-reserved at time of writing)*\n**CWE:** [CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n**Affected Product:** [nooncarlett/TechStore](https://github.com/nooncarlett/TechStore) v1.0\n**Affected Component:** `contact_display` request handler\n\n---\n\n## Summary\n\nThe `TechStore` web application (v1.0) contains a reflected Cross-Site Scripting (XSS) vulnerability in its `contact_display` endpoint. The application echoes the `id` query parameter verbatim into the rendered HTML response without any output encoding or server-side validation, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session.\n\n## Vulnerability Details\n\nThe `contact_display` handler builds its HTML response by directly interpolating the value of the `id` GET parameter into the page without escaping it for the HTML context. Because there is no whitelist validation (e.g., enforcing a numeric-only `id`) and no HTML-context output encoding, any HTML/JavaScript markup supplied in `id` is reflected back and rendered by the browser as part of the page.\n\n**Vulnerable parameter:** `id` (GET)\n**Sink:** Unescaped interpolation into the HTML response body\n\n## Proof of Concept\n\n1. Clone the repository locally:\n ```\n git clone https://github.com/nooncarlett/TechStore\n ```\n2. Install the project's requirements as documented in the repository.\n3. Run the application:\n ```\n python app.py\n ```\n4. In a browser, navigate to:\n ```\n http://127.0.0.1:5001/contact_display?id=1alert('XSS POPUP')\n ```\n5. The injected `` executes and the `alert('XSS POPUP')` dialog fires, confirming the reflected XSS.\n\n## Attack Scenario\n\nBecause the payload is delivered entirely via a GET request, an attacker can weaponize it as a simple link:\n\n```\nhttp:///contact_display?id=1...attacker JS...\n```\n\nThis link can be distributed via phishing email, chat, or social media. When a victim who is logged into the application opens the link, the attacker's script executes in the victim's browser session, with the same access as the victim \u2014 enabling session/cookie theft, unauthorized actions performed as the victim, or delivery of further malicious payloads (e.g., redirects, credential-harvesting overlays).\n\n## Impact\n\n- **Confidentiality:** Disclosure of session tokens / sensitive in-page data reachable by script.\n- **Integrity:** Ability to perform actions as the authenticated victim (e.g., form submissions) via injected script.\n- **Availability:** Not directly impacted.\n\n**Suggested CVSS v3.1 vector (self-assessed):**\n`AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` \u2014 **Base Score: 6.1 (Medium)**\n\n*(Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality: Low, Integrity: Low, Availability: None)*\n\n## Remediation\n\n- Apply context-aware output encoding to any user-controllable value rendered into HTML (e.g., HTML-entity encode `id` before interpolation).\n- Validate/whitelist the `id` parameter server-side (e.g., enforce it is numeric before use).\n- Deploy a restrictive Content-Security-Policy (CSP) to reduce the impact of any residual injection points (e.g., disallow inline `` execution).\n\n## Disclosure Timeline\n\n- Vulnerability discovered and reported to MITRE's CVE Assignment Team (CNA of Last Resort) for the affected open-source project.\n- CVE-2025-63607 reserved and confirmed via official MITRE assignment email.\n- Public write-up published by the discoverer to support record publication.\n\n## References\n\n- [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n- [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n- [MDN: Cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Web/Security/Cross-site_scripting_(XSS))\n- [Affected repository: nooncarlett/TechStore](https://github.com/nooncarlett/TechStore)\n- [CVE Record (pending publication): CVE-2025-63607](https://www.cve.org/CVERecord?id=CVE-2025-63607)\n\n---\n\n*Reported and documented by Mohammed ElKhateb ([HoRRus](https://horrus-offsec.com/)) \u2014 [LinkedIn](https://www.linkedin.com/in/mohammed-elkhateb-horrus) \u00b7 [Hack The Box](https://app.hackthebox.com/users/1506676)*\n", "creation_timestamp": "2026-08-29T00:00:52.457294Z"} {"uuid": "45b45ec8-3d76-408e-96cb-0c5f7dec4d4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63607", "type": "seen", "source": "https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583", "content": "# Reflected Cross-Site Scripting (XSS) in TechStore \u2014 CVE-2025-63607\n\n**Discoverer:** Mohammed ElKhateb (HoRRus)\n**CVE ID:** CVE-2025-63607 *(MITRE-reserved at time of writing)*\n**CWE:** [CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n**Affected Product:** [nooncarlett/TechStore](https://github.com/nooncarlett/TechStore) v1.0\n**Affected Component:** `contact_display` request handler\n\n---\n\n## Summary\n\nThe `TechStore` web application (v1.0) contains a reflected Cross-Site Scripting (XSS) vulnerability in its `contact_display` endpoint. The application echoes the `id` query parameter verbatim into the rendered HTML response without any output encoding or server-side validation, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session.\n\n## Vulnerability Details\n\nThe `contact_display` handler builds its HTML response by directly interpolating the value of the `id` GET parameter into the page without escaping it for the HTML context. Because there is no whitelist validation (e.g., enforcing a numeric-only `id`) and no HTML-context output encoding, any HTML/JavaScript markup supplied in `id` is reflected back and rendered by the browser as part of the page.\n\n**Vulnerable parameter:** `id` (GET)\n**Sink:** Unescaped interpolation into the HTML response body\n\n## Proof of Concept\n\n1. Clone the repository locally:\n ```\n git clone https://github.com/nooncarlett/TechStore\n ```\n2. Install the project's requirements as documented in the repository.\n3. Run the application:\n ```\n python app.py\n ```\n4. In a browser, navigate to:\n ```\n http://127.0.0.1:5001/contact_display?id=1alert('XSS POPUP')\n ```\n5. The injected `` executes and the `alert('XSS POPUP')` dialog fires, confirming the reflected XSS.\n\n## Attack Scenario\n\nBecause the payload is delivered entirely via a GET request, an attacker can weaponize it as a simple link:\n\n```\nhttp:///contact_display?id=1...attacker JS...\n```\n\nThis link can be distributed via phishing email, chat, or social media. When a victim who is logged into the application opens the link, the attacker's script executes in the victim's browser session, with the same access as the victim \u2014 enabling session/cookie theft, unauthorized actions performed as the victim, or delivery of further malicious payloads (e.g., redirects, credential-harvesting overlays).\n\n## Impact\n\n- **Confidentiality:** Disclosure of session tokens / sensitive in-page data reachable by script.\n- **Integrity:** Ability to perform actions as the authenticated victim (e.g., form submissions) via injected script.\n- **Availability:** Not directly impacted.\n\n**Suggested CVSS v3.1 vector (self-assessed):**\n`AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` \u2014 **Base Score: 6.1 (Medium)**\n\n*(Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality: Low, Integrity: Low, Availability: None)*\n\n## Remediation\n\n- Apply context-aware output encoding to any user-controllable value rendered into HTML (e.g., HTML-entity encode `id` before interpolation).\n- Validate/whitelist the `id` parameter server-side (e.g., enforce it is numeric before use).\n- Deploy a restrictive Content-Security-Policy (CSP) to reduce the impact of any residual injection points (e.g., disallow inline `` execution).\n\n## Disclosure Timeline\n\n- Vulnerability discovered and reported to MITRE's CVE Assignment Team (CNA of Last Resort) for the affected open-source project.\n- CVE-2025-63607 reserved and confirmed via official MITRE assignment email.\n- Public write-up published by the discoverer to support record publication.\n\n## References\n\n- [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n- [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n- [MDN: Cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Web/Security/Cross-site_scripting_(XSS))\n- [Affected repository: nooncarlett/TechStore](https://github.com/nooncarlett/TechStore)\n- [CVE Record (pending publication): CVE-2025-63607](https://www.cve.org/CVERecord?id=CVE-2025-63607)\n\n---\n\n*Reported and documented by Mohammed ElKhateb ([HoRRus](https://horrus-offsec.com/)) \u2014 [LinkedIn](https://www.linkedin.com/in/mohammed-elkhateb-horrus) \u00b7 [Hack The Box](https://app.hackthebox.com/users/1506676)*\n", "creation_timestamp": "2026-08-29T00:00:52.457294Z"} https://vulnerability.circl.lu/sighting/45b45ec8-3d76-408e-96cb-0c5f7dec4d4b/export Sat, 29 Aug 2026 00:00:52 +0000 https://vulnerability.circl.lu/sighting/bfcc77e1-0e15-4e35-a558-4048b1ccfd26/export {"uuid": "bfcc77e1-0e15-4e35-a558-4048b1ccfd26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63607", "type": "seen", "source": "https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583", "content": "# Reflected Cross-Site Scripting (XSS) in TechStore \u2014 CVE-2025-63607\n\n**Discoverer:** Mohammed ElKhateb (HoRRus)\n**CVE ID:** CVE-2025-63607 *(MITRE-reserved at time of writing)*\n**CWE:** [CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n**Affected Product:** [nooncarlett/TechStore](https://github.com/nooncarlett/TechStore) v1.0\n**Affected Component:** `contact_display` request handler\n\n---\n\n## Summary\n\nThe `TechStore` web application (v1.0) contains a reflected Cross-Site Scripting (XSS) vulnerability in its `contact_display` endpoint. The application echoes the `id` query parameter verbatim into the rendered HTML response without any output encoding or server-side validation, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session.\n\n## Vulnerability Details\n\nThe `contact_display` handler builds its HTML response by directly interpolating the value of the `id` GET parameter into the page without escaping it for the HTML context. Because there is no whitelist validation (e.g., enforcing a numeric-only `id`) and no HTML-context output encoding, any HTML/JavaScript markup supplied in `id` is reflected back and rendered by the browser as part of the page.\n\n**Vulnerable parameter:** `id` (GET)\n**Sink:** Unescaped interpolation into the HTML response body\n\n## Proof of Concept\n\n1. Clone the repository locally:\n ```\n git clone https://github.com/nooncarlett/TechStore\n ```\n2. Install the project's requirements as documented in the repository.\n3. Run the application:\n ```\n python app.py\n ```\n4. In a browser, navigate to:\n ```\n http://127.0.0.1:5001/contact_display?id=1alert('XSS POPUP')\n ```\n5. The injected `` executes and the `alert('XSS POPUP')` dialog fires, confirming the reflected XSS.\n\n## Attack Scenario\n\nBecause the payload is delivered entirely via a GET request, an attacker can weaponize it as a simple link:\n\n```\nhttp:///contact_display?id=1...attacker JS...\n```\n\nThis link can be distributed via phishing email, chat, or social media. When a victim who is logged into the application opens the link, the attacker's script executes in the victim's browser session, with the same access as the victim \u2014 enabling session/cookie theft, unauthorized actions performed as the victim, or delivery of further malicious payloads (e.g., redirects, credential-harvesting overlays).\n\n## Impact\n\n- **Confidentiality:** Disclosure of session tokens / sensitive in-page data reachable by script.\n- **Integrity:** Ability to perform actions as the authenticated victim (e.g., form submissions) via injected script.\n- **Availability:** Not directly impacted.\n\n**Suggested CVSS v3.1 vector (self-assessed):**\n`AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` \u2014 **Base Score: 6.1 (Medium)**\n\n*(Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality: Low, Integrity: Low, Availability: None)*\n\n## Remediation\n\n- Apply context-aware output encoding to any user-controllable value rendered into HTML (e.g., HTML-entity encode `id` before interpolation).\n- Validate/whitelist the `id` parameter server-side (e.g., enforce it is numeric before use).\n- Deploy a restrictive Content-Security-Policy (CSP) to reduce the impact of any residual injection points (e.g., disallow inline `` execution).\n\n## Disclosure Timeline\n\n- Vulnerability discovered and reported to MITRE's CVE Assignment Team (CNA of Last Resort) for the affected open-source project.\n- CVE-2025-63607 reserved and confirmed via official MITRE assignment email.\n- Public write-up published by the discoverer to support record publication.\n\n## References\n\n- [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n- [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n- [MDN: Cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Web/Security/Cross-site_scripting_(XSS))\n- [Affected repository: nooncarlett/TechStore](https://github.com/nooncarlett/TechStore)\n- [CVE Record (pending publication): CVE-2025-63607](https://www.cve.org/CVERecord?id=CVE-2025-63607)\n\n---\n\n*Reported and documented by Mohammed ElKhateb ([HoRRus](https://horrus-offsec.com/)) \u2014 [LinkedIn](https://www.linkedin.com/in/mohammed-elkhateb-horrus) \u00b7 [Hack The Box](https://app.hackthebox.com/users/1506676)*\n", "creation_timestamp": "2026-08-28T22:31:17.253203Z"} {"uuid": "bfcc77e1-0e15-4e35-a558-4048b1ccfd26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-63607", "type": "seen", "source": "https://gist.github.com/7Horrus/7c419516b064f6bac638736819e24583", "content": "# Reflected Cross-Site Scripting (XSS) in TechStore \u2014 CVE-2025-63607\n\n**Discoverer:** Mohammed ElKhateb (HoRRus)\n**CVE ID:** CVE-2025-63607 *(MITRE-reserved at time of writing)*\n**CWE:** [CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n**Affected Product:** [nooncarlett/TechStore](https://github.com/nooncarlett/TechStore) v1.0\n**Affected Component:** `contact_display` request handler\n\n---\n\n## Summary\n\nThe `TechStore` web application (v1.0) contains a reflected Cross-Site Scripting (XSS) vulnerability in its `contact_display` endpoint. The application echoes the `id` query parameter verbatim into the rendered HTML response without any output encoding or server-side validation, allowing an attacker to inject and execute arbitrary JavaScript in the context of a victim's browser session.\n\n## Vulnerability Details\n\nThe `contact_display` handler builds its HTML response by directly interpolating the value of the `id` GET parameter into the page without escaping it for the HTML context. Because there is no whitelist validation (e.g., enforcing a numeric-only `id`) and no HTML-context output encoding, any HTML/JavaScript markup supplied in `id` is reflected back and rendered by the browser as part of the page.\n\n**Vulnerable parameter:** `id` (GET)\n**Sink:** Unescaped interpolation into the HTML response body\n\n## Proof of Concept\n\n1. Clone the repository locally:\n ```\n git clone https://github.com/nooncarlett/TechStore\n ```\n2. Install the project's requirements as documented in the repository.\n3. Run the application:\n ```\n python app.py\n ```\n4. In a browser, navigate to:\n ```\n http://127.0.0.1:5001/contact_display?id=1alert('XSS POPUP')\n ```\n5. The injected `` executes and the `alert('XSS POPUP')` dialog fires, confirming the reflected XSS.\n\n## Attack Scenario\n\nBecause the payload is delivered entirely via a GET request, an attacker can weaponize it as a simple link:\n\n```\nhttp:///contact_display?id=1...attacker JS...\n```\n\nThis link can be distributed via phishing email, chat, or social media. When a victim who is logged into the application opens the link, the attacker's script executes in the victim's browser session, with the same access as the victim \u2014 enabling session/cookie theft, unauthorized actions performed as the victim, or delivery of further malicious payloads (e.g., redirects, credential-harvesting overlays).\n\n## Impact\n\n- **Confidentiality:** Disclosure of session tokens / sensitive in-page data reachable by script.\n- **Integrity:** Ability to perform actions as the authenticated victim (e.g., form submissions) via injected script.\n- **Availability:** Not directly impacted.\n\n**Suggested CVSS v3.1 vector (self-assessed):**\n`AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` \u2014 **Base Score: 6.1 (Medium)**\n\n*(Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: Required, Scope: Unchanged, Confidentiality: Low, Integrity: Low, Availability: None)*\n\n## Remediation\n\n- Apply context-aware output encoding to any user-controllable value rendered into HTML (e.g., HTML-entity encode `id` before interpolation).\n- Validate/whitelist the `id` parameter server-side (e.g., enforce it is numeric before use).\n- Deploy a restrictive Content-Security-Policy (CSP) to reduce the impact of any residual injection points (e.g., disallow inline `` execution).\n\n## Disclosure Timeline\n\n- Vulnerability discovered and reported to MITRE's CVE Assignment Team (CNA of Last Resort) for the affected open-source project.\n- CVE-2025-63607 reserved and confirmed via official MITRE assignment email.\n- Public write-up published by the discoverer to support record publication.\n\n## References\n\n- [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n- [OWASP Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)\n- [MDN: Cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Web/Security/Cross-site_scripting_(XSS))\n- [Affected repository: nooncarlett/TechStore](https://github.com/nooncarlett/TechStore)\n- [CVE Record (pending publication): CVE-2025-63607](https://www.cve.org/CVERecord?id=CVE-2025-63607)\n\n---\n\n*Reported and documented by Mohammed ElKhateb ([HoRRus](https://horrus-offsec.com/)) \u2014 [LinkedIn](https://www.linkedin.com/in/mohammed-elkhateb-horrus) \u00b7 [Hack The Box](https://app.hackthebox.com/users/1506676)*\n", "creation_timestamp": "2026-08-28T22:31:17.253203Z"} https://vulnerability.circl.lu/sighting/bfcc77e1-0e15-4e35-a558-4048b1ccfd26/export Fri, 28 Aug 2026 22:31:17 +0000