Cross-Site Scripting Vulnerability in Scratch Channel News Website
CVE-2025-53903

1.3LOW

Key Information:

Vendor

The-scratch-channel

Status
The-scratch-channel.github.io
Vendor
CVE Published:
15 July 2025

What is CVE-2025-53903?

The Scratch Channel news website features a vulnerability stemming from improper sanitization of text box inputs found in the /api/users.js file. This oversight can allow attackers to execute malicious scripts in users' browsers, leading to unauthorized actions or data theft. The identified issue has been addressed in commit 90b39eb56b27b2bac29001abb1a3cac0964b8ddb, which implements necessary security measures to sanitize inputs effectively.

Affected Version(s)

the-scratch-channel.github.io < 90b39eb56b27b2bac29001abb1a3cac0964b8ddb

References

https://github.com/The-Scratch-Channel/the-scratch-channe...
x_refsource_CONFIRM
https://github.com/The-Scratch-Channel/the-scratch-channe...
x_refsource_MISC

CVSS V4

Score:
1.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.