CVE-2025-63589 – CMSimple_XH Reflected Cross-Site Scripting (XSS)

CVE ID : CVE-2025-63589

Published : Nov. 6, 2025, 5:15 p.m. | 2 hours, 14 minutes ago

Description : A reflected XSS vulnerability exists in CMSimple_XH 1.8’s index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims’ browsers visiting a crafted URL.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…