A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the application's message system. Unsanitized message content submitted by one user is persisted by the server and later rendered in another user's Inbox view without appropriate context-aware encoding. As a result, attacker-controlled content executes in the recipient's browser context when the Inbox message is viewed.
References
Configurations
History
13 Feb 2026, 16:42
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://drive.google.com/drive/folders/1u2o2NWHzClSjsNzhtkk1QvaDGisAXs2v - Exploit | |
| References | () https://medium.com/@rudranshsinghrajpurohit/cve-2025-63645-stored-cross-site-scripting-xss-vulnerability-in-ph7-social-dating-cms-8073ac4be5be - Third Party Advisory | |
| CPE | cpe:2.3:a:ph7builder:ph7_social_dating_builder:17.9.1:-:*:*:*:*:*:* | |
| First Time |
Ph7builder
Ph7builder ph7 Social Dating Builder |
13 Nov 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
12 Nov 2025, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-12 22:15
Updated : 2026-02-13 16:42
NVD link : CVE-2025-63645
Mitre link : CVE-2025-63645
CVE.ORG link : CVE-2025-63645
JSON object : View
Products Affected
ph7builder
- ph7_social_dating_builder
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')