CVE-2025-63418

MediumCVSS 6.1

Published: 05/11/2025(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the context of a logged-in user's session by injecting payloads via the browser's developer console. The vulnerability arises from client-side code susceptible to direct DOM manipulation without adequate sanitization or a Content Security Policy (CSP).

Risk Assessment

This may lead to account takeover and data theft of the logged-in user.

Recommendation

Implement proper client-side sanitization and a Content Security Policy (CSP), and update the platform to a patched version.

Other vulnerabilities in SelfBest

CVE-2025-63417High
A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of SelfBest platform 2023.3 allows authenticated attackers to inject arbitrary web scripts or HTML via the chat message input field. The malicious content is stored and executed in other users' browsers when they view the message.

Original NVD description (English source)

A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the context of a logged-in user's session by injecting payloads via the browser's developer console. The vulnerability arises from the application's client-side code being susceptible to direct DOM manipulation without adequate sanitization or a Content Security Policy (CSP), potentially leading to account takeover and data theft.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS