PT-2025-31720 · Partner · Partner Web Application+1

Published 2025-08-02 · Updated 2025-09-25 · CVE-2025-6078

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Partner Software's Partner Software application and Partner Web application (affected versions not specified)

Description The application does not completely sanitize input on the 'Notes' page when viewing a job, allowing an authenticated user to add notes containing HTML tags and JavaScript. This can lead to stored cross-site scripting (XSS) where an attacker adds a note containing malicious JavaScript.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2025-6078

Affected Products

Partner Software Application

Partner Web Application

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-6078 · Security Note
• https://kb.cert.org/vuls/id/317469 · Note
• https://partnersoftware.com/resources/software-release-info-4-32 · Note
• https://twitter.com/CVEnew/status/1951479006882115612 · Twitter Post
• https://t.me/cveNotify/130659 · Telegram Post
• https://t.me/CVEtracker/29000 · Telegram Post
• https://t.me/cveNotify/136367 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1951488189559976263 · Twitter Post