PT-2025-46165 · Sourcecodester · Simple To-Do List System

Published 2025-11-10 · Updated 2025-11-18 · CVE-2025-63709

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Simple To-Do List System version 1.0

Description A Cross-Site Scripting (XSS) issue exists in the "Add Tasks" text input. An authenticated user can submit HTML or JavaScript that is not properly sanitized or encoded before being displayed. This allows the injected script to be stored and executed in the browser of any user viewing the task, enabling arbitrary script execution within the victim's browser context. The vulnerable input is located in the 'Add Tasks' field.

Recommendations Apply sanitization and encoding to all user-supplied input in the "Add Tasks" text input to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-63709

Affected Products

Simple To-Do List System

References · 7

• 🔥 https://github.com/floccocam-cpu/CVE-Research-2025/tree/main/CVE-2025-63709 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-63709 · Security Note
• https://osv.dev/vulnerability/CVE-2025-63709 · Vendor Advisory
• https://t.me/cveNotify/143219 · Telegram Post
• https://twitter.com/CVEnew/status/1987902647353880605 · Twitter Post
• https://t.me/CVEtracker/36921 · Telegram Post
• https://sourcecodester.com/php/17897/simple-do-list-system-using-php.html · Note