PT-2025-43671 · Plane · Plane

Published 2025-10-24 · Updated 2025-10-28 · CVE-2025-62716

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.1.0

Description Plane is open-source project management software. A flaw exists in the ?next path query parameter that allows attackers to supply arbitrary schemes, such as javascript:, which are then directly passed to router.push. This results in a cross-site scripting (XSS) issue, potentially enabling attackers to execute arbitrary JavaScript in a victim’s browser. The issue can be exploited without authentication and may lead to information disclosure, privilege escalation, and modifications of administrative settings. The vulnerable parameter is next path. The API endpoint involved is not explicitly mentioned.

Recommendations Update to version 1.1.0 or later.

Exploit

Fix

LPE

Open Redirect

XSS

Weakness Enumeration

CWE-601

CWE-79

Related Identifiers

CVE-2025-62716

GHSA-6FJ7-XGPG-MJ6F

Affected Products

Plane

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62716.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-62716 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62716 · Security Note
• https://github.com/makeplane/plane/security/advisories/GHSA-6fj7-xgpg-mj6f · Note
• https://t.me/CVEtracker/35712 · Telegram Post
• https://twitter.com/CveTodo/status/1983098688353325186 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981865852849766819 · Twitter Post
• https://twitter.com/CVEnew/status/1981821937727746205 · Twitter Post