CVE-2025-63417

HighCVSS 7.2

Published: 05/11/2025(UTC)Updated: 27/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of SelfBest platform 2023.3 allows authenticated attackers to inject arbitrary web scripts or HTML via the chat message input field. The malicious content is stored and executed in other users' browsers when they view the message.

Risk Assessment

Could lead to session hijacking, account takeover, or other client-side attacks against users viewing the malicious message. Requires an authenticated attacker.

Recommendation

Update the platform to a patched version or implement input sanitization and encoding for chat data. Consider deploying Content-Security-Policy headers.

Other vulnerabilities in SelfBest

CVE-2025-63418Medium
A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the context of a logged-in user's session by injecting payloads via the browser's developer console. The vulnerability arises from client-side code susceptible to direct DOM manipulation without adequate sanitization or a Content Security Policy (CSP).

Original NVD description (English source)

A Stored Cross-Site Scripting (XSS) vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated attackers to inject arbitrary web scripts or HTML via the chat message input field. This malicious content is stored and then executed in the context of other users' browsers when they view the malicious message, potentially leading to session hijacking, account takeover, or other client-side attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS