PT-2025-47600 · Unknown · Soplanning

Łukasz Jaworski · Published 2025-11-20 · Updated 2025-11-24 · CVE-2025-62731

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions SOPlanning versions prior to 1.55

Description SOPlanning is susceptible to a Stored Cross-Site Scripting (XSS) issue within the /feries endpoint. A malicious actor with access to the public holidays feature can inject arbitrary HTML and JavaScript code into the website. This injected code will be rendered and executed when various pages are accessed. By default, access to this endpoint is limited to administrators and users with specific privileges.

Recommendations Update to version 1.55 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62731

Affected Products

Soplanning

References · 8

• https://osv.dev/vulnerability/CVE-2025-62731 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62731 · Security Note
• https://twitter.com/VulmonFeeds/status/1991678442236953086 · Twitter Post
• https://soplanning.org/en · Note
• https://twitter.com/CVEnew/status/1991535328604352585 · Twitter Post
• https://t.me/CVEtracker/37841 · Telegram Post
• https://t.me/cveNotify/143781 · Telegram Post
• https://cert.pl/en/posts/2025/11/CVE-2025-62293 · Note