A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Settings module, where unsanitized user input in Address fields (City, State, Country/Region) is rendered back to the page. Attackers can inject arbitrary JavaScript code, which executes when the affected profile page is viewed. This can lead to session hijacking, cookie theft, or arbitrary script execution in the victim's browser.
References
| Link | Resource |
|---|---|
| https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377 | Third Party Advisory |
| https://www.coohom.com/pub/saas/settings/account | Permissions Required |
| https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377 | Third Party Advisory |
Configurations
History
16 Dec 2025, 19:57
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:coohom:coohom:2025-10-28:*:*:*:*:*:*:* | |
| First Time |
Coohom coohom
Coohom |
|
| References | () https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377 - Third Party Advisory | |
| References | () https://www.coohom.com/pub/saas/settings/account - Permissions Required |
11 Dec 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| References | () https://gist.github.com/garux-sec/ec9a6b6e7e4b617b7245ec18252a6377 - |
09 Dec 2025, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-09 19:15
Updated : 2025-12-16 19:57
NVD link : CVE-2025-65300
Mitre link : CVE-2025-65300
CVE.ORG link : CVE-2025-65300
JSON object : View
Products Affected
coohom
- coohom
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')