PT-2025-45495 · Sourcecodester · Ai-Powered To-Do List App

Published 2025-11-07 · Updated 2025-11-07 · CVE-2025-63638

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodester AI-Powered To-Do List App version 1.0

Description The application is susceptible to Cross-Site Scripting (XSS) attacks. Specifically, the "Task Title" and "Description (Optional)" fields are vulnerable when creating a new task. An attacker can inject malicious HTML or JavaScript code into these fields. This code will then execute in a victim's browser when they click the "Add Task" button. The API endpoint used for task creation is not specified. The vulnerable parameters are Task Title and Description (Optional).

Recommendations Sourcecodester AI-Powered To-Do List App version 1.0: Sanitize user input for the Task Title and Description (Optional) fields to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63638

Affected Products

Ai-Powered To-Do List App

References · 6

• 🔥 https://github.com/ChuckBartowski7/Vulnerability-Research/tree/main/CVE-2025-63638 · Exploit
• https://osv.dev/vulnerability/CVE-2025-63638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-63638 · Security Note
• https://twitter.com/CVEnew/status/1986891619438879228 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1986902947016454367 · Twitter Post
• https://sourcecodester.com/javascript/18421/ai-powered-do-list-app-using-html-css-and-javascript-source-code.html · Note