CVE-2025-65300

MEDIUM

Coohom SaaS Platform feVersion=1760060603897 - Stored Cross-Site Scripting in Account Settings Address Fields

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-65300. PoCs published by garux-sec.

AI-analyzed exploit summary This repository contains a detailed writeup for CVE-2025-65300, a stored XSS vulnerability in the Coohom SaaS Platform. It describes the vulnerability, affected components, impact, attack vector, and proof of concept steps.

Description

A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Settings module, where unsanitized user input in Address fields (City, State, Country/Region) is rendered back to the page. Attackers can inject arbitrary JavaScript code, which executes when the affected profile page is viewed. This can lead to session hijacking, cookie theft, or arbitrary script execution in the victim's browser.

Exploits (1)

nomisec WRITEUP
by garux-sec · poc
https://github.com/garux-sec/CVE-2025-65300

This repository contains a detailed writeup for CVE-2025-65300, a stored XSS vulnerability in the Coohom SaaS Platform. It describes the vulnerability, affected components, impact, attack vector, and proof of concept steps.

Classification
Writeup 100%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: Coohom SaaS Platform (feVersion=1760060603897)
Auth required
Prerequisites: Authenticated user access to Coohom SaaS Platform
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 5.4
EPSS 0.0016
EPSS Percentile 5.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
coohom/coohom 2025-10-28
Published Dec 09, 2025
Tracked Since Feb 18, 2026