CVE-2025-70458

{"id": "CVE-2025-70458", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-70458", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-26T15:40:00.575285Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-01-23T22:16:15.360", "references": [{"url": "https://github.com/ismaildawoodjee/vulnerability-research/security/advisories/GHSA-chm7-vgf7-6f9p", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.sourcecodester.com/php/18500/domain-availability-checker-using-php-and-javascript-source-code.html", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the DomainCheckerApp class within domain/script.js of Sourcecodester Domain Availability Checker v1.0. The vulnerability occurs because the application improperly handles user-supplied data in the createResultElement method by using the unsafe innerHTML property to render domain search results."}, {"lang": "es", "value": "Una vulnerabilidad de cross-site scripting (XSS) basada en DOM existe en la clase DomainCheckerApp dentro de domain/script.js de Sourcecodester Domain Availability Checker v1.0. La vulnerabilidad ocurre porque la aplicaci\u00f3n maneja incorrectamente los datos proporcionados por el usuario en el m\u00e9todo createResultElement al usar la propiedad insegura innerHTML para renderizar los resultados de b\u00fasqueda de dominio."}], "lastModified": "2026-06-17T10:03:20.333", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:remyandrade:domain_availability_checker:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "74B1DD83-26CA-4E69-A7E1-06F013582A56"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}