XSS in Chuck24 Simple To-Do List System
CVE-2025-63709
A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. The injected script is stored and later rendered in the browser of any user who views the task, allowing execution of arbitrary script in the context of the victim's browser.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (14.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Chuck24 Simple_to-do_list_system — versions 1.0
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Product)
- cve@mitre.org (Exploit, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2025-63709?
- CVE-2025-63709 is a medium-severity vulnerability in Chuck24 Simple To-Do List System, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-11-10.
- How severe is CVE-2025-63709?
- Medium severity. CVSS v3 base score is 5.4 out of 10.