CVE-2025-10088
BaseFortify
Publication date: 2025-09-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| rems | personal_time_tracker | 1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-10088 is a Reflected Cross-Site Scripting (XSS) vulnerability in the SourceCodester Time Tracker 1.0 web application, specifically in the project name input field on the /index.html page. The vulnerability occurs because user input is directly injected into the webpage's DOM using innerHTML without proper sanitization or encoding. This allows an attacker to inject malicious JavaScript code that executes immediately in the victim's browser when the crafted input is processed, potentially compromising user sessions or enabling further attacks. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary JavaScript code in the context of a victim's browser session. This can lead to session hijacking, defacement, or other malicious actions such as stealing sensitive information or performing unauthorized actions on behalf of the user. The attack is remote and can be initiated by submitting malicious input through the project name field, which is then reflected and executed in the victim's browser. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the project name input field on the /index.html page for reflected cross-site scripting (XSS). A common method is to submit a payload such as `<img src=x onerror=alert('XSS')>` into the project name field and observe if the script executes in the browser. Additionally, attackers may use Google dorking with queries like "inurl:index.html" to identify vulnerable targets. There are no specific network commands provided, but manual or automated web application security testing tools can be used to inject and detect XSS payloads in the project-name parameter. [2, 3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding the use of the affected SourceCodester Time Tracker version 1.0 or replacing it with an alternative solution, as no known countermeasures or patches are documented. Additionally, input sanitization and encoding should be implemented on the project name input field to prevent injection of malicious scripts. Until a fix is available, restricting access to the vulnerable application and educating users about the risk of executing untrusted scripts can help reduce exposure. [3]