Stored Cross-Site Scripting Vulnerability in pH7Software's Social Dating CMS
CVE-2025-63644

5.4MEDIUM

Key Information:

Vendor

pH7Software

Status
pH7-Social-Dating-CMS
Vendor
CVE Published:
14 January 2026

What is CVE-2025-63644?

A stored cross-site scripting (XSS) vulnerability in pH7Software's pH7-Social-Dating-CMS version 17.9.1 allows malicious users to inject script code into the user profile Description field. This could lead to unauthorized access and manipulation of data by executing harmful scripts within the context of the user's browser. The vulnerability poses significant risks to user privacy and data integrity, making it crucial for users to be aware and take appropriate security measures.

References

https://drive.google.com/drive/folders/1mYDvUTnlTPCGTB-7t...
https://medium.com/@rudranshsinghrajpurohit/cve-2025-6364...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.