XSS in Chuck24 Simple To-Do List System
CVE-2025-63709
A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. The injected script is stored and later rendered in the browser of any user who views the task, allowing execution of arbitrary script in the context of the victim's browser.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (13.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 13th percentile — 13.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Chuck24 Simple To-Do List System — versions 1.0
Weakness classification (CWE)
References
- www.sourcecodester.com/php/17897/simple-do-list-system-using-php.html (Product)
- github.com/floccocam-cpu/CVE-Research-2025/tree/main/CVE-2025-63709 (Exploit, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2025-63709?
- CVE-2025-63709 is a medium-severity vulnerability in Chuck24 Simple To-Do List System, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2025-11-10.
- How severe is CVE-2025-63709?
- Medium severity. CVSS v3 base score is 5.4 out of 10.