Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Release: SOPlanning 1.55 Clear all filters
TI-2025-38921 CVE-2025-62731 · GHSA-83gp-m2fc-8ph7

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /feries endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00183 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38919 CVE-2025-62729 · GHSA-xfmv-jwvw-h264

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /status endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0018 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38589 CVE-2025-62297 · GHSA-9gf2-fc34-c75c

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /projets endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0018 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38588 CVE-2025-62296 · GHSA-84qf-h2cw-8mc2

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /taches endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0018 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38587 CVE-2025-62295 · GHSA-78h9-h7hw-grrr

Stored XSS in SOPlanning

Priority LOW 22

SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.0018 Published 2025-11-20 Fixed in 1.55 CWE-79
TI-2025-38586 CVE-2025-62294 · GHSA-vm86-vfwq-9qvc

Predictable Generation of Password Recovery Token

Priority MEDIUM 44

SOPlanning is vulnerable to Predictable Generation of Password Recovery Token.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00324 Published 2025-11-20 Fixed in 1.55 CWE-340
TI-2025-38585 CVE-2025-62293 · GHSA-xq7p-cgf2-m4vv

Broken Access Control in SOPlanning

Priority LOW 23

SOPlanning is vulnerable to Broken Access Control in /status endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00182 Published 2025-11-20 Fixed in 1.55 CWE-862