Vulnerability Details CVE-2025-63693
The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and execute arbitrary JavaScript code when the victim opens the editing pop-up.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 4.3%
CVSS Severity
CVSS v3 Score 5.4
References
Products affected by CVE-2025-63693
-
cpe:2.3:a:dzzoffice:dzzoffice:1.3.1
-
cpe:2.3:a:dzzoffice:dzzoffice:2.0
-
cpe:2.3:a:dzzoffice:dzzoffice:2.01
-
cpe:2.3:a:dzzoffice:dzzoffice:2.02
-
cpe:2.3:a:dzzoffice:dzzoffice:2.02.1
-
cpe:2.3:a:dzzoffice:dzzoffice:2.02.1_sc_utf8
-
cpe:2.3:a:dzzoffice:dzzoffice:2.3.0
-
cpe:2.3:a:dzzoffice:dzzoffice:2.3.2
-
cpe:2.3:a:dzzoffice:dzzoffice:2.3.3
-
cpe:2.3:a:dzzoffice:dzzoffice:2.3.4
-
cpe:2.3:a:dzzoffice:dzzoffice:2.3.5
-
cpe:2.3:a:dzzoffice:dzzoffice:2.3.7