CVE-2025-63693: Code Injection
The comment editing template (dzz/comment/template/editform.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and execute arbitrary JavaScript code when the victim opens the editing pop-up.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63693?
CVE-2025-63693 has been classified as a high-severity vulnerability due to its potential to allow low-privilege attackers to exploit user-controllable data.
How do I fix CVE-2025-63693?
To fix CVE-2025-63693, ensure that adequate security escaping for user-controllable data is implemented in the comment editing template.
What software is affected by CVE-2025-63693?
CVE-2025-63693 affects DzzOffice versions 2.3.0 and above.
What type of attack does CVE-2025-63693 facilitate?
CVE-2025-63693 facilitates cross-site scripting (XSS) attacks due to insufficient sanitization of user inputs.
Can low-privilege users exploit CVE-2025-63693?
Yes, low-privilege users can exploit CVE-2025-63693 to inject malicious content into the comment section.