CVE-2025-63589: XSS
A reflected XSS vulnerability exists in CMSimpleXH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims' browsers visiting a crafted URL.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63589?
CVE-2025-63589 is classified as a reflected XSS vulnerability which poses a medium to high risk depending on its exploitation context.
How do I fix CVE-2025-63589?
To fix CVE-2025-63589, sanitize and encode user input before it is inserted into the generated HTML output in the CMSimple_XH index.php router.
Which versions of CMSimple_XH are affected by CVE-2025-63589?
CVE-2025-63589 affects CMSimple_XH version 1.8.0.
What types of attacks can CVE-2025-63589 enable?
CVE-2025-63589 can enable attackers to execute malicious scripts in the context of a user's browser session.
How can I identify if my website is vulnerable to CVE-2025-63589?
To identify if your website is vulnerable to CVE-2025-63589, test input fields that generate HTML output for reflected XSS using attacker-controlled paths.