CVE-2025-63713

{
  "id": "CVE-2025-63713",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-07T18:15:36.373",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Scripting (XSS) vulnerability in SourceCodester \"MatchMaster\" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test titles and matching pair items before rendering them in the DOM during test execution."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de cross-site scripting (XSS) en SourceCodester ’MatchMaster’ 1.0 permite a atacantes remotos inyectar scripts web o HTML arbitrarios a través de una entrada manipulada en la función de creación de pruebas personalizadas. La vulnerabilidad existe porque la aplicación no logra sanear adecuadamente la entrada proporcionada por el usuario en los títulos de las pruebas y los elementos de pares coincidentes antes de renderizarlos en el DOM durante la ejecución de la prueba."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-12T19:48:39.393214Z",
          "id": "CVE-2025-63713",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:remyandrade:matching_type_test:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4946409-420D-4572-8038-6DA2B6FC20AC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63713/README7.md",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Mitigation",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.sourcecodester.com/javascript/18431/matching-type-test-using-html-css-and-javascript-source-code.html",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}