PT-2025-45496 · Unknown · Sourcecodester Faq Bot With Ai Assistant

Published 2025-11-07 · Updated 2025-11-07 · CVE-2025-63639

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sourcecodester FAQ Bot with AI Assistant version 1.0

Description The application’s chat feature is susceptible to Cross-Site Scripting (XSS) because of inadequate handling of user-provided input. An attacker can inject malicious HTML or JavaScript into chat messages, leading to execution within the browser of any user viewing the conversation. The chat feature is affected. The vulnerable component allows for the injection of malicious code through user input.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider sanitizing all user-supplied input before displaying it in the chat feature.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63639

Affected Products

Sourcecodester Faq Bot With Ai Assistant

References · 6

• 🔥 https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-63639/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63639 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63639 · Vendor Advisory
• https://twitter.com/CVEnew/status/1986894741888258152 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1986900386892939720 · Twitter Post
• https://sourcecodester.com/javascript/18413/faq-bot-ai-assistant-using-html-css-and-javascript-source-code.html · Note