CVE-2025-65300 Cross-site scripting in n/a
Attackers can inject malicious scripts into user profile address fields, leading to session hijacking or cookie theft when victims view the profile.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-65300?
CVE-2025-65300 is a medium-severity cross-site scripting vulnerability in n/a, published on 9 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Settings module, where unsanitized user input in Address fields (City, State, Country/Region) is rendered back to the page. Attackers can inject arbitrary JavaScript code, which executes when the affected profile page is viewed. This can lead to session hijacking, cookie theft, or arbitrary script execution in the victim's browser.
Weakness: CWE-79
Which versions are affected by CVE-2025-65300?
It affects 1 product.
Products include Coohom Coohom.
How do I fix CVE-2025-65300?
No fix has been published for CVE-2025-65300 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-65300 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65300 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-jj62-qf33-64j2.