CVE-2025-63714

medium

Description

Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via crafted input in the Username Prefix field. The vulnerability exists due to improper sanitization of user-supplied input when rendering generated account data to the DOM, allowing persistent injection of malicious HTML elements that execute when clicked by users.

References

https://www.sourcecodester.com/javascript/18430/modern-user-account-generator-using-html-css-and-javascript-source-code.html

https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63714/README10.md

Details

Source: Mitre, NVD

Published: 2025-11-07

Updated: 2025-11-12

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.00077