PT-2025-47597 · Unknown · Soplanning

Łukasz Jaworski · Published 2025-11-20 · Updated 2025-11-24 · CVE-2025-62297

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.55

Description SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue in the /projets API endpoint. An attacker with medium privileges can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when an edited page is opened.

Recommendations Update SOPlanning to version 1.55 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62297

Affected Products

Soplanning

References · 7

• https://osv.dev/vulnerability/CVE-2025-62297 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62297 · Security Note
• https://t.me/cveNotify/143778 · Telegram Post
• https://soplanning.org/en · Note
• https://t.me/CVEtracker/37838 · Telegram Post
• https://twitter.com/CVEnew/status/1991535331993354241 · Twitter Post
• https://cert.pl/en/posts/2025/11/CVE-2025-62293 · Note