PT-2025-50213 · Coohom · Coohom

Published 2025-12-09 · Updated 2025-12-22 · CVE-2025-65300

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Coohom SaaS Platform version 1760060603897 (2025-10-28)

Description A stored Cross-Site Scripting (XSS) issue exists in the Account Settings module. The issue occurs because unsanitized user input in Address fields, specifically City, State, and Country/Region, is rendered back to the page. An attacker can inject arbitrary JavaScript code that executes when the affected profile page is viewed, potentially leading to session hijacking, cookie theft, or arbitrary script execution in the victim's browser.

Recommendations Sanitize user input in the Address fields (City, State, Country/Region) within the Account Settings module to prevent the injection of malicious scripts.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65300

Affected Products

Coohom

References · 5

• 🔥 https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377 · Exploit
• https://osv.dev/vulnerability/CVE-2025-65300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65300 · Security Note
• https://coohom.com/pub/saas/settings/account · Note
• https://twitter.com/CVEnew/status/2003233992204820843 · Twitter Post