CVE-2025-70368

Katalog CVE

CVSS 5.4 · Medium EPSS 0,25%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada worklenz. Skor CVSS 3.1 5.4 (Medium) menurut CISA ADP.

Deskripsi (NVD)

Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in the Updates text field which is then rendered in the reporting view without proper sanitization. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.

Rincian

Terbit di NVD

26 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Stolichnayer/CVE-2025-70368 exploit · advisory pihak ketiga
• https://github.com/Worklenz/worklenz product