PT-2025-47596 · Unknown · Soplanning

Łukasz Jaworski · Published 2025-11-20 · Updated 2025-11-24 · CVE-2025-62296

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.55

Description SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue within the /taches endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when the editor is opened.

Recommendations Update SOPlanning to version 1.55 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62296

Affected Products

Soplanning

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-62296 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62296 · Vendor Advisory
• https://twitter.com/CVEnew/status/1991535332945457227 · Twitter Post
• https://soplanning.org/en · Note
• https://cert.pl/en/posts/2025/11/CVE-2025-62293 · Note
• https://t.me/cveNotify/143777 · Telegram Post
• https://t.me/CVEtracker/37837 · Telegram Post