Stored Cross-Site Scripting Vulnerability in Konsola Proget by InfinIT
CVE-2025-1419

2.4LOW

Key Information:

Vendor

Proget

Status
Proget
Vendor
CVE Published:
21 May 2025

What is CVE-2025-1419?

The Konsola Proget application has a vulnerability that allows high-privileged users to execute stored cross-site scripting (XSS) attacks. This occurs because the input provided in the comment section isn't properly sanitized, potentially giving attackers the ability to inject malicious scripts. Users are advised to upgrade to version 2.17.5 or later, where this issue has been addressed.

Affected Version(s)

Proget 0 < 2.17.5

References

https://cert.pl/en/posts/2025/05/CVE-2025-1415
third-party-advisory
https://proget.pl/en/mobile-device-management/
product

CVSS V4

Score:
2.4
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcin Węgłowski (AFINE)
.
CVE-2025-1419 : Stored Cross-Site Scripting Vulnerability in Konsola Proget by InfinIT