Riskcovery

CVE-2025-53904

The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerability

State
Published
Severity
1.3 Low
Published
Jul 16, 2025
Updated
Jul 18, 2025
Reserved
Jul 11, 2025

Read the record on cve.org

Description

The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` contains code that could make the website vulnerable to cross-site scripting. No known patches exist as of time of publication.

Scores

CVSSScoreVectorSource
4.01.3 LowCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:UGitHub_M

Weaknesses

  • CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-692 Incomplete Denylist to Cross-Site Scripting

Affected Products

ProductVersions
the-scratch-channel.github.ioThe-Scratch-Channel
  • <= b66a1cae45e05ad8971aecd96c3322520f8a5725Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.