PT-2026-1801 · Unknown · Workdo Ecommercego

Published 2026-01-12 · Updated 2026-01-12 · CVE-2025-40978

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions WorkDo eCommerceGo SaaS (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue exists due to insufficient validation of user-supplied data. The issue involves sending a POST request to the ''/ticket/x/conversion'' API endpoint, specifically utilizing the reply description parameter. This allows for the injection of malicious scripts.

Recommendations Ensure proper validation and sanitization of user input for the reply description parameter in the ''/ticket/x/conversion'' API endpoint.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40978

Affected Products

Workdo Ecommercego

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-40978 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-workdo-products · Note
• https://twitter.com/VulmonFeeds/status/2010691584874913934 · Twitter Post
• https://t.me/cveNotify/148406 · Telegram Post
• https://t.me/CVEtracker/41983 · Telegram Post
• https://twitter.com/CVEnew/status/2010681453693034790 · Twitter Post