CVE-2025-63607: n/a

The vulnerability in TechStore 1.0 is a reflected Cross Site Scripting (XSS) issue identified as CVE-2025-63607. The application improperly handles the id parameter in the contact_display page by echoing it verbatim into the rendered HTML. This lack of input validation or output encoding permits an attacker to inject malicious JavaScript code that executes in the context of the victim's browser session. The CVSS vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality and integrity with no impact on availability.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or manipulation of the user interface. The confidentiality and integrity of user data can be compromised, but availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with the contact_display page and avoid clicking on suspicious links. Developers should implement proper input validation and output encoding to prevent script injection in the id parameter.