CVE-2025-66845

MediumCVSS 6.1

Published: 23/12/2025(UTC)Updated: 04/11/2026(UTC)Translated: 04/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0. The user_name endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim's browser.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's browser, steal session or login data, and perform actions on behalf of the victim. This may lead to data theft or account takeover.

Recommendation

Update TechStore to a patched version or implement output encoding and validation of the id parameter in the user_name endpoint. Additionally, deploy Content-Security-Policy headers to restrict script execution.

Other vulnerabilities in TechStore

CVE-2025-63607Medium
TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS