CVE-2025-63714

{
  "id": "CVE-2025-63714",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-07T18:15:36.503",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Scripting (XSS) vulnerability in SourceCodester User Account Generator 1.0 allows remote attackers to execute arbitrary JavaScript code in the context of the user's browser session via crafted input in the Username Prefix field. The vulnerability exists due to improper sanitization of user-supplied input when rendering generated account data to the DOM, allowing persistent injection of malicious HTML elements that execute when clicked by users."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de cross-site scripting (XSS) en SourceCodester User Account Generator 1.0 permite a atacantes remotos ejecutar código JavaScript arbitrario en el contexto de la sesión del navegador del usuario a través de entrada manipulada en el campo Username Prefix. La vulnerabilidad existe debido a una sanitización inadecuada de la entrada proporcionada por el usuario al renderizar los datos de cuenta generados en el DOM, permitiendo la inyección persistente de elementos HTML maliciosos que se ejecutan al ser clicados por los usuarios."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-12T19:46:16.260451Z",
          "id": "CVE-2025-63714",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:remyandrade:modern_user_account_generator:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4858668C-57A9-4859-9738-896B6E7FD545"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63714/README10.md",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.sourcecodester.com/javascript/18430/modern-user-account-generator-using-html-css-and-javascript-source-code.html",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    }
  ]
}