CVE-2025-60312 Details
Description
Sourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a remote attacker to inject arbitrary HTML/JavaScript code that executes in the victim's browser upon clicking the "Convert to HTML" button.
A cross-site scripting (XSS) vulnerability has been identified in Sourcecodester Markdown to HTML Converter version 1.0. The issue resides in the 'Markdown Input' field, where a remote attacker can inject arbitrary HTML or JavaScript. This injected code executes in the victim's browser when the 'Convert to HTML' button is clicked.
To mitigate this vulnerability, implement input validation and sanitization to rigorously check and encode user-supplied data before rendering it. Consider applying a Content Security Policy (CSP) to restrict script sources and prevent the execution of inline scripts. Properly encode data based on the context before outputting it, and use secure frameworks or libraries that automatically handle escaping to prevent XSS. Additionally, mark session cookies as HttpOnly to prevent access via client-side scripts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 8, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-60312/README.md | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/ChuckBartowski7/Vulnerability-Research/blob/main/CVE-2025-60312/README.md | [email protected] | ExploitThird Party Advisory |
| https://www.sourcecodester.com/php/18295/markdown-html-converter-using-php-and-javascript-source-code.html | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| rems markdown to html converter | 1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2025 | Initial Analysis | [email protected] |
| Oct 8, 2025 | CVE Modified | CISA-ADP |
| Oct 7, 2025 | New CVE Received | [email protected] |