Exploitation Summary
EIP tracks 1 public exploit for CVE-2025-63708. PoCs published by DylanDavis1.
AI-analyzed exploit summary The PoC demonstrates a stored XSS vulnerability in 'AI Font Matcher' by intercepting the `webfonts` fetch response and injecting malicious JavaScript via unsanitized font family names. It includes a proof-of-concept script that triggers an alert and a cookie exfiltration example.
Description
Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly sanitized. An attacker can intercept fetch requests to the webfonts endpoint and inject malicious JavaScript payloads through font family names, resulting in session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users. The vulnerability can be exploited by injecting a fetch hook that returns controlled font data containing malicious scripts.
Exploits (1)
The PoC demonstrates a stored XSS vulnerability in 'AI Font Matcher' by intercepting the `webfonts` fetch response and injecting malicious JavaScript via unsanitized font family names. It includes a proof-of-concept script that triggers an alert and a cookie exfiltration example.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N