Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting (XSS) due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing the conversation.

CVE-2025-63639 identifies a Cross-Site Scripting (XSS) vulnerability in the chat component of Sourcecodester FAQ Bot with AI Assistant version 1.0. The vulnerability stems from inadequate sanitization and validation of user-supplied input within chat messages, allowing attackers to embed malicious HTML or JavaScript code. When other users access the chat and view these crafted messages, the injected scripts execute in their browsers under the context of the vulnerable application. This can lead to theft of session cookies, unauthorized actions on behalf of the user, or redirection to malicious sites. The vulnerability has been assigned a CVSS v3.1 base score of 6.1, reflecting medium severity, with an attack vector of network (remote), low attack complexity, no privileges required, but requiring user interaction (viewing the message). The scope is changed, indicating that the vulnerability affects components beyond the initially vulnerable part, potentially impacting user data confidentiality and integrity. No patches or official fixes have been published yet, and there are no known exploits in the wild. The vulnerability is categorized under CWE-79, which is a common web application security weakness related to improper neutralization of input during web page generation. This flaw is particularly concerning in chat applications where user input is frequently exchanged and displayed dynamically. Without proper output encoding or input filtering, malicious actors can exploit this to compromise other users' sessions or inject phishing content. The lack of authentication requirements for exploitation means that any remote attacker can attempt to exploit this vulnerability by sending crafted chat messages. However, exploitation requires that a victim user views the malicious content, making social engineering or phishing tactics likely components of an attack. The vulnerability's impact is primarily on confidentiality and integrity, with no direct denial of service or availability impact reported. Organizations using this software for customer support or internal communication should be aware of the risk of data leakage or session hijacking through this vector. Given the absence of patches, mitigation currently relies on implementing input validation, output encoding, and possibly disabling or restricting the chat feature until a fix is available.

Detailed information about CVE-2025-63639: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-63639: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-63639: n/a

Threats Tagged 'cve-2025-63639'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-63639'

Lead Pen Test Professional