314 matches found
CVE-2025-62729: Improper Neutralization of Input During Web Page Generation
SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55...
CVE-2025-62730: Incorrect Authorization
SOPlanning is vulnerable to Privilege Escalation in user management tab. Users with usermanageteam role are allowed to modify permissions of users. However, they are able to assign administrative permissions to any user including themselves. This allow a malicious authenticated attacker with this...
CVE-2025-62731: Improper Neutralization of Input During Web Page Generation
SOPlanning is vulnerable to Stored XSS in /feries endpoint. Malicious attacker with access to public holidays feature is able to inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. By default only administrators and users with special privileges...
SOPlanning Cross-Site Scripting Vulnerabilities
SOPlanning is a suite of online project management software from SOPlanning, Inc. A cross-site scripting vulnerability exists in SOPlanning versions prior to 1.55, which stems from a /feries endpoint that does not properly clean input and could lead to stored cross-site scripting...
SOPlanning security vulnerabilities
SOPlanning is a suite of online project management software from SOPlanning, Inc. A security vulnerability exists in SOPlanning versions prior to 1.55 that stems from an improper assignment of privileges in the User Management tab, which could result in elevated privileges...
SOPlanning Cross-Site Scripting Vulnerabilities
SOPlanning is a suite of online project management software from SOPlanning, Inc. A cross-site scripting vulnerability exists in SOPlanning versions prior to 1.55, which stems from the /projets endpoint that does not properly clean its input, and could lead to stored cross-site scripting...
SOPlanning Cross-Site Scripting Vulnerabilities
SOPlanning is a suite of online project management software from SOPlanning, Inc. A cross-site scripting vulnerability exists in SOPlanning versions prior to 1.55, which stems from the /status endpoint that does not properly clean inputs, and could lead to stored cross-site scripting...
SOPlanning Cross-Site Scripting Vulnerabilities
SOPlanning is a suite of online project management software from SOPlanning, Inc. A cross-site scripting vulnerability exists in SOPlanning versions prior to 1.55, which stems from a failure of the /taches endpoint to properly clean input and could lead to stored cross-site scripting...
SOPlanning security vulnerabilities
SOPlanning is a suite of online project management software from SOPlanning, Inc. A security vulnerability exists in SOPlanning versions prior to 1.55 that stems from a weak password recovery token generation mechanism that could lead to account takeover...
SOPlanning security vulnerabilities
SOPlanning is a suite of online project management software from SOPlanning, Inc. A security vulnerability exists in SOPlanning versions prior to 1.55, which stems from a lack of permission checking in the /status endpoint that could lead to improper access control...
CVE-2025-41001
Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...
CVE-2025-41001
Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...
EUVD-2025-44042
Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...
CVE-2025-41001
CVE-2025-41001: Stored XSS in SOPlanning 1.53.02 arises from insufficient validation of the LOGOUT_REDIRECT parameter in /soplanning/www/process/options.php. The issue can allow an attacker to inject crafted input that is persisted and later delivered to an authenticated user, enabling theft of c...
SOPlanning Cross-Site Scripting Vulnerabilities
SOPlanning is a suite of online project management software from SOPlanning, Inc. A cross-site scripting vulnerability exists in SOPlanning version 1.53.02, which stems from insufficient validation of user input for the parameter LOGOUTREDIRECT in the file /soplanning/www/process/options.php, whi...
CVE-2025-41001: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...
PT-2025-45610
Name of the Vulnerable Software and Affected Versions SOPlanning version 1.53.02 Description A stored Cross Site Scripting XSS issue exists in SOPlanning version 1.53.02. This is due to insufficient validation of user-supplied data. An attacker can exploit this by sending a POST request utilizing...
EUVD-2020-30096
Malware in sbrugna...