PT-2025-47598 · Unknown · Soplanning

Łukasz Jaworski · CVE-2025-62729 · Published 2025-11-20 · Updated 2025-11-24

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.55

Description SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue within the /status endpoint. An attacker possessing an account can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when other users access various pages.

Recommendations Update SOPlanning to version 1.55 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62729

Affected Products

Soplanning

References · 7

• https://osv.dev/vulnerability/CVE-2025-62729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62729 · Security Note
• https://soplanning.org/en · Note
• https://twitter.com/CVEnew/status/1991535330940612636 · Twitter Post
• https://t.me/cveNotify/143779 · Telegram Post
• https://t.me/CVEtracker/37839 · Telegram Post
• https://cert.pl/en/posts/2025/11/CVE-2025-62293 · Note