Stored Cross-Site Scripting Flaw in Pleasanter's Attachment Preview Feature
CVE-2025-58070

5.1MEDIUM

Key Information:

Vendor

Implem Inc.

Status
Pleasanter
Vendor
CVE Published:
24 October 2025

What is CVE-2025-58070?

Pleasanter has a stored cross-site scripting vulnerability within its attachment preview feature that can allow attackers to inject and execute arbitrary scripts in the web browsers of logged-in users. This can lead to unauthorized access and data manipulation, emphasizing the need for effective security measures.

Affected Version(s)

Pleasanter 1.4.20.0 and earlier versions

References

https://pleasanter.org/archives/vulnerability-update-2025...
https://jvn.jp/en/jp/JVN20611740/

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.