PT-2025-45159 · Unknown · Selfbest Platform

Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-63418

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SelfBest platform version 2023.3

Description A DOM-based Cross-Site Scripting (XSS) issue exists in the SelfBest platform. This allows attackers to execute arbitrary JavaScript within a logged-in user's session. The attack vector involves injecting payloads via the browser's developer console. The root cause is the application's client-side code being vulnerable to direct DOM manipulation without proper sanitization or a Content Security Policy (CSP). This could potentially lead to account takeover and data theft.

Recommendations Apply a Content Security Policy (CSP) to mitigate DOM-based XSS attacks. Sanitize all user-supplied data before rendering it in the DOM.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63418

Affected Products

Selfbest Platform

References · 4

• 🔥 https://rohitchaudhary045.medium.com/cve-2025-63418-weaponizing-the-browser-console-a-dom-based-xss-deep-dive-25ed3ac9cb53 · Exploit
• https://osv.dev/vulnerability/CVE-2025-63418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63418 · Security Note
• https://t.me/CVEtracker/36646 · Telegram Post