CVE-2025-67641

Jenkins Coverage Plugin 2.3054.ve1ff7baa123b and earlier does not validate the configured coverage results ID when creating coverage results, only when submitting the job configuration through the UI, allowing attackers with Item/Configure permission to use a javascript: scheme URL as identifier ...

Cross-site Scripting (XSS)

Jenkins Coverage Plugin is vulnerable to a stored Cross-Site Scripting. The vulnerability is caused by missing validation of the coverage results ID when configured via the REST API, allowing attackers with Item/Configure permission to inject a javascript: URL that executes in users’ browsers...

EUVD-2025-202455

Jenkins Coverage Plugin has a stored cross-site scripting XSS vulnerability...

CVE-2025-67641

The Jenkins Coverage Plugin (versions 2.3054.ve1ff7b_a_a_123b and earlier) is vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is a lack of validation for the configured coverage results ID when creating results via the REST API ; while the UI performs this check, the API do...