PT-2025-50213 · Coohom · Coohom

CVE-2025-65300 · Publicado 2025-12-09 · Atualizado 2025-12-22

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Coohom SaaS Platform version 1760060603897 (2025-10-28)

Description A stored Cross-Site Scripting (XSS) issue exists in the Account Settings module. The issue occurs because unsanitized user input in Address fields, specifically City, State, and Country/Region, is rendered back to the page. An attacker can inject arbitrary JavaScript code that executes when the affected profile page is viewed, potentially leading to session hijacking, cookie theft, or arbitrary script execution in the victim's browser.

Recommendations Sanitize user input in the Address fields (City, State, Country/Region) within the Account Settings module to prevent the injection of malicious scripts.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-65300

Produtos afetados

Coohom

Referências · 5

• 🔥 https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377 · Exploit
• https://osv.dev/vulnerability/CVE-2025-65300 · Aviso do Fabricante
• https://coohom.com/pub/saas/settings/account · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-65300 · Nota de Segurança
• https://twitter.com/CVEnew/status/2003233992204820843 · Publicação no Twitter