PT-2025-47595 · Unknown · Soplanning

Łukasz Jaworski · CVE-2025-62295 · Published 2025-11-20 · Updated 2025-11-24

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.55

Description SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue in the /groupe form endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when the editor is opened.

Recommendations Update to version 1.55 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62295

Affected Products

Soplanning

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-62295 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62295 · Vendor Advisory
• https://t.me/cveNotify/143776 · Telegram Post
• https://soplanning.org/en · Note
• https://twitter.com/CVEnew/status/1991535333864009839 · Twitter Post
• https://cert.pl/en/posts/2025/11/CVE-2025-62293 · Note
• https://t.me/CVEtracker/37836 · Telegram Post