CVE-2025-63588

HIGH EPSS 20.9%
Published Nov 6, 20257mo ago · Modified Jun 17, 20261w ago
7.1 CVSS 3.1
High
Find Similar
Published Nov 6, 2025 7mo ago
Last Modified Jun 17, 2026 1w ago

Description

An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a maliciously crafted POST login). Successful exploitation may lead to theft of session cookies, credential disclosure, or other client-side impacts.

CVSS Details

Base Score
7.1
Exploitability
2.8
Impact
4.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
20.9% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available

Weaknesses 1

CWE-79 Cross-site Scripting Injection

Affected Products 1

VendorProductVersionRange
cmsimple-xhcmsimple_xh1.8.0any

References 2

  • github.com https://github.com/cybercrewinc/CVE-2025-63588
    ExploitThird Party Advisory
  • helloandrewpaul.medium.com https://helloandrewpaul.medium.com/reflected-xss-in-login-form-email-password-fields-vvveb-cms-v1-0-7-2-18800186804d
    Not Applicable

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.