CVE-2025-63883 Details
Description
A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 (Bhabishya-123/E-commerce). The site's client-side JavaScript reads attacker-controlled input (for example, values derived from the URL or page fragment) and inserts it into the DOM via unsafe sinks (innerHTML/insertAdjacentHTML/document.write) without proper sanitization or context-aware encoding. An attacker can craft a malicious URL that, when opened by a victim, causes arbitrary JavaScript to execute in the victim's browser under the electic-shop origin.
A DOM-based cross-site scripting vulnerability has been identified in Electric-Shop version 1.0, a project hosted on GitHub. This vulnerability allows for arbitrary execution of JavaScript in the context of the user's browser under the Electric-Shop origin. The issue arises because the site's client-side JavaScript improperly handles user input from the URL or page fragment, injecting it into the DOM using unsafe methods like innerHTML, insertAdjacentHTML, and document.write, without adequate sanitization or context-aware encoding.
To address this vulnerability, remove unsafe DOM sinks such as innerHTML, insertAdjacentHTML, and document.write. Instead, use safe DOM APIs like textContent and setAttribute. It's also important to sanitize untrusted client-side input and apply a strict Content Security Policy.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 18, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/minhajultaivin/security-advisories/blob/main/CVE-2025-63883.md | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| bhabishya-123 e-commerce | 1.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 4, 2026 | Initial Analysis | [email protected] |
| Nov 18, 2025 | New CVE Received | [email protected] |
| Nov 18, 2025 | CVE Modified | CISA-ADP |