Cross-Site Scripting (XSS) vulnerability in SourceCodester "MatchMaster" 1.0 allows remote attackers to inject arbitrary web script or HTML via crafted input in the custom test creation feature. The vulnerability exists because the application fails to properly sanitize user-supplied input in test titles and matching pair items before rendering them in the DOM during test execution.
References
| Link | Resource |
|---|---|
| https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63713/README7.md | Exploit Mitigation Third Party Advisory |
| https://www.sourcecodester.com/javascript/18431/matching-type-test-using-html-css-and-javascript-source-code.html | Product |
Configurations
History
18 Nov 2025, 19:33
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:remyandrade:matching_type_test:1.0:*:*:*:*:*:*:* | |
| References | () https://github.com/floccocam-cpu/CVE-Research-2025/blob/main/CVE-2025-63713/README7.md - Exploit, Mitigation, Third Party Advisory | |
| References | () https://www.sourcecodester.com/javascript/18431/matching-type-test-using-html-css-and-javascript-source-code.html - Product | |
| First Time |
Remyandrade matching Type Test
Remyandrade |
12 Nov 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
07 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-11-07 18:15
Updated : 2025-11-18 19:33
NVD link : CVE-2025-63713
Mitre link : CVE-2025-63713
CVE.ORG link : CVE-2025-63713
JSON object : View
Products Affected
remyandrade
- matching_type_test
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')