PT-2026-3552 · Bdtask · Isshue

Published 2026-01-20 · Updated 2026-01-20 · CVE-2025-40679

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Isshue by Bdtask (affected versions not specified)

Description An HTML injection issue exists in Isshue by Bdtask due to insufficient validation of user-supplied data. The issue occurs when sending a POST request to the /category product search API endpoint, specifically through the product name parameter. This allows for the injection of arbitrary HTML code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-40679

Affected Products

Isshue

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-40679 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso-sci/html-injection-isshue-bdtask · Note
• https://twitter.com/CVEnew/status/2013591852512133195 · Twitter Post
• https://t.me/cveNotify/149259 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2013669883418955981 · Twitter Post