CVE-2025-65300

A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Settings module, where unsanitized user input in Address fields (City, State, Country/Region) is rendered back to the page. Attackers can inject arbitrary JavaScript code, which executes when the affected profile page is viewed. This can lead to session hijacking, cookie theft, or arbitrary script execution in the victim's browser.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377	Third Party Advisory
https://www.coohom.com/pub/saas/settings/account	Permissions Required
https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:coohom:coohom:2025-10-28:*:*:*:*:*:*:*

History

04 Nov 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de Cross-Site Scripting (XSS) almacenada existe en la Plataforma SaaS Coohom feVersion=1760060603897 (2025-10-28) en el módulo de Configuración de Cuenta, donde la entrada de usuario no saneada en los campos de Dirección (Ciudad, Estado, País/Región) se renderiza de vuelta a la página. Los atacantes pueden inyectar código JavaScript arbitrario, que se ejecuta cuando se visualiza la página de perfil afectada. Esto puede llevar a secuestro de sesión, robo de cookies o ejecución de script arbitrario en el navegador de la víctima.

Information

Published : 2025-12-09 19:15

Updated : 2026-11-04 22:10

NVD link : CVE-2025-65300

Mitre link : CVE-2025-65300

CVE.ORG link : CVE-2025-65300

JSON object : View

Products Affected

coohom

coohom

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-65300", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65300", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-11T19:15:02.332057Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-09T19:15:49.410", "references": [{"url": "https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.coohom.com/pub/saas/settings/account", "tags": ["Permissions Required"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Settings module, where unsanitized user input in Address fields (City, State, Country/Region) is rendered back to the page. Attackers can inject arbitrary JavaScript code, which executes when the affected profile page is viewed. This can lead to session hijacking, cookie theft, or arbitrary script execution in the victim's browser."}, {"lang": "es", "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) almacenada existe en la Plataforma SaaS Coohom feVersion=1760060603897 (2025-10-28) en el m\u00f3dulo de Configuraci\u00f3n de Cuenta, donde la entrada de usuario no saneada en los campos de Direcci\u00f3n (Ciudad, Estado, Pa\u00eds/Regi\u00f3n) se renderiza de vuelta a la p\u00e1gina. Los atacantes pueden inyectar c\u00f3digo JavaScript arbitrario, que se ejecuta cuando se visualiza la p\u00e1gina de perfil afectada. Esto puede llevar a secuestro de sesi\u00f3n, robo de cookies o ejecuci\u00f3n de script arbitrario en el navegador de la v\u00edctima."}], "lastModified": "2026-11-04T22:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:coohom:coohom:2025-10-28:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FD9CC2A-BFEF-44C0-8943-6A8B6C11701F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}