CVE-2025-63416
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of SelfBest platform 2023.3 allows authenticated low-privileged attackers to execute arbitrary JavaScript in the context of other users' sessions. This can be exploited to access administrative data and functions, leading to privilege escalation and full compromise of sensitive user data.
Risk Assessment
Attackers can hijack other users' sessions, including administrators, and exfiltrate sensitive data such as the contents of the /admin/users endpoint.
Recommendation
Implement input validation and output encoding in the chat functionality and update SelfBest to a patched version; consider deploying CSP.
Other vulnerabilities in SelfBest
See all- CVE-2025-63418Medium
A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the context of a logged-in user's session by injecting payloads via the browser's developer console. The vulnerability arises from client-side code susceptible to direct DOM manipulation without adequate sanitization or a Content Security Policy (CSP).
- CVE-2025-63417High
A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of SelfBest platform 2023.3 allows authenticated attackers to inject arbitrary web scripts or HTML via the chat message input field. The malicious content is stored and executed in other users' browsers when they view the message.
Original NVD description (English source)
** exclusively-hosted-service ** A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated low-privileged attackers to execute arbitrary JavaScript in the context of other users' sessions. This can be exploited to access administrative data and functions, leading to privilege escalation and full compromise of sensitive user data, as demonstrated by the ability to fetch and exfiltrate the contents of the /admin/users endpoint.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS