PT-2026-46209 · Gigtodoscript · Gigtodo

M0Ze · Published 2026-06-04 · Updated 2026-06-04 · CVE-2019-25739

NVD

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

GigToDo 1.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript and HTML code through the proposal description field. Attackers can craft XSS payloads in the create proposal endpoint that execute when administrators or other users view the stored proposal, enabling cookie theft and malicious redirects.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-25739

Affected Products

Gigtodo

References · 5

• 🔥 https://exploit-db.com/exploits/47185 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25739 · Security Note
• https://gigtodoscript.com · Note
• https://codecanyon.net/item/gigtodo-freelance-marketplace-script/23855397 · Note
• https://vulncheck.com/advisories/gigtodo-freelance-marketplace-script-persistent-xss · Note