PT-2025-3798 · Unknown · Code-Projects Local Storage Todo App

Fergod · Published 2025-01-05 · Updated 2025-01-10 · CVE-2025-0228

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions code-projects Local Storage Todo App version 1.0

Description A problem has been found in the code that affects the /js-todo-app/index.html file. The issue arises from the manipulation of the Add argument, leading to cross-site scripting. This can be initiated remotely. The exploit for this issue has been made public.

Recommendations For code-projects Local Storage Todo App version 1.0, consider disabling the Add argument functionality until a patch is available to prevent cross-site scripting attacks. Restrict access to the /js-todo-app/index.html file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-0228

Affected Products

Code-Projects Local Storage Todo App

References · 11

• https://osv.dev/vulnerability/CVE-2025-0228 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0228 · Security Note
• https://t.me/cvenotify/106352 · Telegram Post
• https://twitter.com/CVEnew/status/1875978144454217946 · Twitter Post
• https://vuldb.com/?id.290218 · Note
• https://vuldb.com/?ctiid.290218 · Note
• https://vuldb.com/?submit.474049 · Note
• https://twitter.com/VulmonFeeds/status/1875988785340539328 · Twitter Post
• https://t.me/cvedetector/14312 · Telegram Post
• https://t.me/cvenotify/107095 · Telegram Post
• https://code-projects.org · Note