Stored Cross-Site Scripting Vulnerability in Pleasanter by Pleasanter
CVE-2025-61931

4.8MEDIUM

Key Information:

Vendor

Implem Inc.

Status
Pleasanter
Vendor
CVE Published:
24 October 2025

What is CVE-2025-61931?

Pleasanter is susceptible to a stored cross-site scripting vulnerability affecting the Body, Description, and Comments fields. This flaw allows an attacker to inject and execute arbitrary scripts within the web browsers of logged-in users, potentially leading to unauthorized access or data breaches. Users are advised to apply updates promptly to mitigate the risk associated with this vulnerability.

Affected Version(s)

Pleasanter 1.4.20.0 and earlier versions

References

https://pleasanter.org/archives/vulnerability-update-2025...
https://jvn.jp/en/jp/JVN20611740/

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.