CVE-2025-63709

Name: CVE-2025-63709
Creator: NVD / NIST
Published: 2025-11-10T15:15:37.793+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.4/10EPSS 0.20%

Last modified Jun 17, 2026

CVE-2025-63709 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. The injected script is stored and later rendered in the browser of any user who views the task, allowing execution of arbitrary script in the context of the victim's browser.

Metrics

CVSS 3.1

5.4/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

0.20%

10.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Chuck24	Simple To-Do List System	1.0

References

https://github.com/floccocam-cpu/CVE-Research-2025/tree/main/CVE-2025-63709Exploit, Mitigation, Third Party Advisory
https://www.sourcecodester.com/php/17897/simple-do-list-system-using-php.htmlProduct

Timeline

Published: Nov 10, 2025
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2025-63709?

How severe is CVE-2025-63709?

CVE-2025-63709 has a CVSS score of 5.4/10 (MEDIUM severity). The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.

How do I fix CVE-2025-63709?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-63709?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST