CVE-2025-63883

{
  "id": "CVE-2025-63883",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-18T15:16:36.097",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 (Bhabishya-123/E-commerce). The site's client-side JavaScript reads attacker-controlled input (for example, values derived from the URL or page fragment) and inserts it into the DOM via unsafe sinks (innerHTML/insertAdjacentHTML/document.write) without proper sanitization or context-aware encoding. An attacker can craft a malicious URL that, when opened by a victim, causes arbitrary JavaScript to execute in the victim's browser under the electic-shop origin."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de cross-site scripting basada en DOM existe en electic-shop v1.0 (Bhabishya-123/E-commerce). El JavaScript del cliente del sitio lee entrada controlada por el atacante (por ejemplo, valores derivados de la URL o del fragmento de página) y la inserta en el DOM a través de sinks inseguros (innerHTML/insertAdjacentHTML/document.write) sin una sanitización adecuada o codificación consciente del contexto. Un atacante puede crear una URL maliciosa que, al ser abierta por una víctima, provoca la ejecución de JavaScript arbitrario en el navegador de la víctima bajo el origen de electic-shop."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-18T14:59:59.798555Z",
          "id": "CVE-2025-63883",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bhabishya-123:e-commerce:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "90D50823-AA94-4347-9B60-7D06EB491E97"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/minhajultaivin/security-advisories/blob/main/CVE-2025-63883.md",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}