CVE-2025-63708

MEDIUM

SourceCodester AI Font Matcher - XSS

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-63708. PoCs published by DylanDavis1.

AI-analyzed exploit summary The PoC demonstrates a stored XSS vulnerability in 'AI Font Matcher' by intercepting the `webfonts` fetch response and injecting malicious JavaScript via unsanitized font family names. It includes a proof-of-concept script that triggers an alert and a cookie exfiltration example.

Description

Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly sanitized. An attacker can intercept fetch requests to the webfonts endpoint and inject malicious JavaScript payloads through font family names, resulting in session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users. The vulnerability can be exploited by injecting a fetch hook that returns controlled font data containing malicious scripts.

Exploits (1)

nomisec WORKING POC
by DylanDavis1 · poc
https://github.com/DylanDavis1/CVE-2025-63708

The PoC demonstrates a stored XSS vulnerability in 'AI Font Matcher' by intercepting the `webfonts` fetch response and injecting malicious JavaScript via unsanitized font family names. It includes a proof-of-concept script that triggers an alert and a cookie exfiltration example.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: AI Font Matcher (SourceCodester package as of 2025-10-10)
No auth needed
Prerequisites: Victim must interact with the vulnerable application · Attacker must control or intercept the `webfonts` fetch response
MITRE ATT&CK
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 6.1
EPSS 0.0022
EPSS Percentile 12.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
remyandrade/ai_font_matcher 2025-10-10
Published Nov 17, 2025
Tracked Since Feb 18, 2026