Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
CVE-2025-62729: SOPlanning allows attackers to inject malicious code into website
CVE-2025-62729 · published 11 months ago
Summary
A malicious user with an account on SOPlanning can add code to the website that will be executed when certain pages are loaded, potentially compromising the security of the site. This can allow an attacker to steal sensitive information or take control of the website. Update to version 1.55 to fix this issue.
What to do
- Update soplanning soplanning to version 1.55.00 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| soplanning | soplanning |
< 1.55.00 cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:* |
Original advisory text
SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple p...
SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages.
This issue was fixed in version 1.55.
This issue was fixed in version 1.55.
References
- https://cert.pl/en/posts/2025/11/CVE-2025-62293 Third Party Advisory
- https://www.soplanning.org/en/ Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published20 Nov 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-62729 · NVD
Track software like this
Free during beta