CVE-2025-63693
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The comment editing template in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to execute arbitrary JavaScript code when the victim opens the editing pop-up.
Risk Assessment
An attacker could hijack a user's browser session or perform actions on their behalf. The risk affects all DzzOffice 2.3.x installations with comment functionality enabled.
Recommendation
Update DzzOffice to a version containing the fix or implement additional input filtering and escaping in the comment editing template. Consider restricting comment functionality to trusted users until the patch is applied.
Other vulnerabilities in DzzOffice
See all- CVE-2025-63695Critical
DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.
- CVE-2025-63694Critical
DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.
- CVE-2022-43340High
A Cross-Site Request Forgery (CSRF) vulnerability in dzzoffice 2.02.1_SC_UTF8 allows attackers to arbitrarily create user accounts and grant Administrator rights to regular users.
Original NVD description (English source)
The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and execute arbitrary JavaScript code when the victim opens the editing pop-up.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS