BaseFortify

Publication date: 2025-11-20

Last updated on: 2025-11-24

Assigner: CERT.PL

Description

SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-20

Last Modified

2025-11-24

Generated

2026-07-06

AI Q&A

2025-11-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62729

Affected Vendors & Products

Vendor	Product	Version / Range
soplanning	soplanning	to 1.55.00 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Mitigation Strategies

Upgrade SOPlanning to version 1.55 or later, where this Stored XSS vulnerability in the /status endpoint has been fixed.

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) issue in the /status endpoint of SOPlanning. A malicious attacker who has an account can inject arbitrary HTML and JavaScript code into the website. This injected code will be executed when users open multiple pages, potentially compromising their interaction with the site.

Impact Analysis

The vulnerability can allow attackers to execute malicious scripts in the context of the victim's browser. This can lead to theft of session tokens, defacement, or unauthorized actions performed on behalf of the user, potentially compromising user data and site integrity.

Hi! I’m here to help you understand CVE-2025-62729. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70