CVE-2025-63607

Deferred Deferred - Pending Action

Cross Site Scripting (XSS) in TechStore 1.0 Contact Display

Publication date: 2026-08-31

Last updated on: 2026-09-01

Assigner: MITRE

Description

TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-09-01

Generated

2026-09-21

AI Q&A

2026-09-01

EPSS Evaluated

2026-09-15

NVD

CVE-2025-63607

Affected Vendors & Products

Vendor	Product	Version / Range
techstore	techstore	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

TechStore 1.0 has a Cross Site Scripting (XSS) vulnerability in the contact_display feature. The application directly outputs the id parameter without sanitization, allowing attackers to inject malicious JavaScript code that executes in the browsers of other users.

Detection Guidance

To detect this XSS vulnerability in TechStore 1.0, inspect the contact_display page for improper handling of the id parameter. Check if the parameter is reflected without sanitization in the HTML output. Use browser developer tools to inspect network requests and responses for the id parameter. Test by injecting harmless JavaScript like <script>alert(1)</script> in the id parameter and observe if it executes.

Impact Analysis

This vulnerability could allow attackers to steal user sessions, deface web pages, or perform actions on behalf of users. If you use TechStore 1.0, your browser could execute unauthorized scripts when visiting affected pages.

Compliance Impact

This XSS vulnerability may violate GDPR by enabling unauthorized data access or processing. For HIPAA, it could compromise protected health information if user sessions are hijacked. Compliance depends on the specific implementation and data involved.

Mitigation Strategies

Immediately apply input validation and output encoding to sanitize the id parameter in the contact_display page. Ensure all user-supplied input is properly escaped before rendering in HTML. Update TechStore to the latest patched version if available. Consider implementing a Content Security Policy (CSP) to mitigate the impact of XSS attacks.

Hi! I’m here to help you understand CVE-2025-63607. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70