CVE-2025-63607

MediumCVSS 6.1

Published: 31/08/2026(UTC)Updated: 26/10/2026(UTC)Translated: 01/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.

Risk Assessment

An attacker can steal session data, take over user accounts, or conduct phishing attacks in the context of a trusted domain.

Recommendation

Update TechStore to a patched version or apply output encoding for the id parameter.

Other vulnerabilities in TechStore

CVE-2025-66845Medium
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0. The user_name endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim's browser.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS