CVE-2025-63709

Name of the Vulnerable Software and Affected Versions SourceCodester Simple To-Do List System version 1.0

Description A Cross-Site Scripting (XSS) issue exists in the "Add Tasks" text input. An authenticated user can submit HTML or JavaScript that is not properly sanitized or encoded before being displayed. This allows the injected script to be stored and executed in the browser of any user viewing the task, enabling arbitrary script execution within the victim's browser context. The vulnerable input is located in the 'Add Tasks' field.

Recommendations Apply sanitization and encoding to all user-supplied input in the "Add Tasks" text input to prevent the injection of malicious scripts.