CVE-2025-65368: XSS

Q: What does an attacker need to exploit this issue?

The attacker must cause a user to interact with malicious user-supplied content or LLM-generated output. The CVSS vector indicates no attacker privileges are required, but user interaction is required.

Q: What is the potential impact of successful exploitation?

Successful exploitation may allow cross-site scripting in the context of the affected application. The reported CVSS metrics indicate low impact to confidentiality and integrity, with no reported availability impact and a changed scope.

Q: Which version is identified as affected?

SparkyFitness version 0.15.8.2 is identified as vulnerable. The provided information does not identify fixed versions or whether other versions are affected.

Published Jan 15, 2026

Updated

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.

Affected Software

2 affected components

SparkyFitness SparkyFitness

Codewithcj Sparkyfitness<=0.15.8.2

Event History

Jan 15, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·09:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker must cause a user to interact with malicious user-supplied content or LLM-generated output. The CVSS vector indicates no attacker privileges are required, but user interaction is required.

What is the potential impact of successful exploitation?

Successful exploitation may allow cross-site scripting in the context of the affected application. The reported CVSS metrics indicate low impact to confidentiality and integrity, with no reported availability impact and a changed scope.

Which version is identified as affected?