CVE-2025-63607: XSS
Published Aug 31, 2026
·Updated
TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser.
Affected Software
1 affected component
TechStore=1.0
Event History
Aug 31, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·09:17 PM
Description
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
An attacker needs to cause a user to load the contact_display functionality with a malicious id parameter. The application reflects that parameter into the rendered page without sanitization, allowing attacker-supplied JavaScript to execute in the user's browser.
2
Which deployments are known to be affected?
The provided information identifies TechStore 1.0 as affected. It does not state whether other versions, configurations, or deployments are vulnerable.