CVE-2025-63708: XSS
Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly sanitized. An attacker can intercept fetch requests to the webfonts endpoint and inject malicious JavaScript payloads through font family names, resulting in session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users. The vulnerability can be exploited by injecting a fetch hook that returns controlled font data containing malicious scripts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-63708?
CVE-2025-63708 is classified as a Cross-Site Scripting (XSS) vulnerability, which can have a significant impact on affected users.
How does CVE-2025-63708 affect users?
CVE-2025-63708 allows remote attackers to execute arbitrary JavaScript in victims' browsers, potentially compromising sensitive information.
How do I fix CVE-2025-63708?
To remedy CVE-2025-63708, ensure that proper input validation and output encoding are implemented in the webfonts API handling mechanism.
Which software is affected by CVE-2025-63708?
CVE-2025-63708 affects SourceCodester AI Font Matcher and related applications that utilize the vulnerable webfonts API.
What can attackers achieve by exploiting CVE-2025-63708?
Attackers exploiting CVE-2025-63708 can inject malicious scripts, leading to data theft or unauthorized actions on behalf of users.