CVE-2025-62716

Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?nextpath query parameter allows attackers to supply arbitrary schemes e.g., javascript: that are passed directly to router.push. This results in a cross-site scripting XSS vulnerabilit...

CVE-2025-62716

Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?nextpath query parameter allows attackers to supply arbitrary schemes e.g., javascript: that are passed directly to router.push. This results in a cross-site scripting XSS vulnerabilit...

CVE-2025-62716 Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter

Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?nextpath query parameter allows attackers to supply arbitrary schemes e.g., javascript: that are passed directly to router.push. This results in a cross-site scripting XSS vulnerabilit...

CVE-2025-62716

Plane is an open-source project management tool. A vulnerability in versions prior to 1.1.0 is an open redirect in the ?next_path query parameter that accepts arbitrary schemes (e.g., javascript:) and passes them to router.push, causing cross-site scripting (XSS). The issue can be exploited witho...

PT-2025-43671

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.1.0 Description Plane is open-source project management software. A flaw exists in the ?next path query parameter that allows attackers to supply arbitrary schemes, such as javascript:, which are then directly passed ...