CVE-2025-63638

MEDIUM 6.1CVE-2025-63638 · Published 07/11/2025 · updated 17/06/2026

In short

CVE-2025-63638 is a MEDIUM (CVSS 6.1) vulnerability affecting ai-powered to-do list app (remyandrade).
Chance of exploitation in the next 30 days (EPSS): 0.24%, higher than 15.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ai-powered to-do list app remyandrade	`= 1.0`	No fix yet

Description

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting (XSS) in the "Task Title" and "Description (Optional)" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicking the "Add Task" button.

References

ChuckBartowski7/Vulnerability-Research · Exploit
sourcecodester.com/javascript/18421/ai-powered-do-list-app-using-html-css-and-javascript-source-code.html · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free