BaseFortify

Publication date: 2025-10-24

Last updated on: 2025-10-27

Assigner: JPCERT/CC

Description

Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-24

Last Modified

2025-10-27

Generated

2026-07-06

AI Q&A

2025-10-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-58070

EUVD

EUVD-2025-35799

Affected Vendors & Products

Vendor	Product	Version / Range
implem	pleasanter	1.4.21.0
implem	pleasanter	1.4.20.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in Pleasanter's Preview for Attachments feature. It allows an attacker to inject and execute arbitrary scripts in the web browser of a logged-in user.

Impact Analysis

The vulnerability can lead to unauthorized script execution in a user's browser, potentially allowing attackers to steal sensitive information, hijack user sessions, or perform actions on behalf of the user without their consent.

Hi! I’m here to help you understand CVE-2025-58070. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70