CVE-2025-10088: Rems Personal Time Tracker XSS Vulnerability

CVE-2025-10088 Overview

CVE-2025-10088 is a reflected cross-site scripting (XSS) vulnerability in SourceCodester Personal Time Tracker 1.0, developed by Rems. The flaw resides in an unspecified function within the /index.html file. Attackers can manipulate the project-name parameter to inject arbitrary JavaScript that executes in the victim's browser session. The attack can be launched remotely, and a public proof-of-concept exploit is already available. This vulnerability is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Remote attackers can execute arbitrary script code in a victim's browser through crafted project-name input, potentially leading to session hijacking, credential theft, or unauthorized actions within the application.

Affected Products

Rems Personal Time Tracker 1.0
Distributed via SourceCodester
Component: /index.html (client-side handling of project-name parameter)

Discovery Timeline

2025-09-08 - CVE-2025-10088 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10088

Vulnerability Analysis

The vulnerability is a client-side cross-site scripting flaw affecting the Personal Time Tracker web application. The project-name argument, submitted through /index.html, is rendered back into the page without proper encoding or sanitization. An attacker who supplies HTML or JavaScript content in this parameter causes the payload to execute in the browser context of any user who processes the crafted input.

Because the application is a lightweight tracker distributed as source code, exploitation requires user interaction, such as opening a malicious link or loading attacker-controlled data. Successful exploitation runs script code with the privileges of the current session and can facilitate cookie theft, DOM manipulation, or phishing overlays. A public exploit is referenced by VulDB entry #323044 and a GitHub proof-of-concept repository.

Root Cause

The root cause is missing output encoding when reflecting user-controlled input into the HTML response. The application takes the project-name value and inserts it directly into the DOM without applying context-aware escaping such as HTML entity encoding or JavaScript string encoding.

Attack Vector

The attack originates over the network. An attacker crafts a malicious link or form submission containing a script payload in the project-name parameter and delivers it to a user through phishing, chat, or an embedded link. When the user loads the resulting page, the browser parses and executes the injected script under the origin of the Personal Time Tracker instance.

Because no verified code sample is available beyond the public proof-of-concept, refer to the GitHub PoC repository for exploitation details.

Detection Methods for CVE-2025-10088

Indicators of Compromise

Requests to /index.html containing HTML tags, angle brackets, or javascript: schemes within the project-name parameter.
Server or proxy logs showing URL-encoded script fragments such as %3Cscript%3E in query strings targeting the Personal Time Tracker.
Browser console errors or content-security-policy violations reported by users interacting with the application.

Detection Strategies

Deploy web application firewall (WAF) signatures that flag XSS patterns in the project-name query parameter.
Review HTTP access logs for anomalous payloads targeting /index.html, focusing on encoded angle brackets, event handlers such as onerror=, and inline script tags.
Enable browser-side reporting via Content Security Policy (CSP) report-uri or report-to directives to capture attempted script injections.

Monitoring Recommendations

Alert on outbound requests to unfamiliar domains initiated from sessions using Personal Time Tracker, which may indicate exfiltration by injected scripts.
Monitor endpoint telemetry for suspicious browser child processes or credential-access behavior following user interaction with tracker links.
Track user reports of unexpected redirects, pop-ups, or session terminations tied to the application.

How to Mitigate CVE-2025-10088

Immediate Actions Required

Restrict access to Personal Time Tracker 1.0 instances so they are not exposed to untrusted networks.
Instruct users to avoid clicking unsolicited links referencing the tracker, especially those containing project-name parameters.
Apply a strict Content Security Policy that blocks inline scripts and unauthorized external script sources.

Patch Information

No vendor patch has been published for Personal Time Tracker 1.0 at the time of this writing. Consult the VulDB entry and the SourceCodester project page for future updates. Organizations should evaluate whether the application is essential and consider replacing it with a maintained alternative.

Workarounds

Add server-side or reverse-proxy filtering that HTML-encodes or rejects project-name values containing <, >, ", ', or & characters.
Modify the application source to escape user input before rendering, using context-appropriate encoding libraries.
Enforce a Content Security Policy header such as Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none' to limit script execution.
Isolate the tracker behind authenticated VPN access to reduce exposure to remote attackers.

bash

# Example NGINX reverse-proxy hardening
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer" always;

# Reject requests containing script-like payloads in project-name
if ($arg_project_name ~* "(<|%3C)script|javascript:|onerror=|onload=") {
    return 403;
}