Stored XSS Vulnerability in SOPlanning by SOPlanning
CVE-2025-62731

5.1MEDIUM

Key Information:

Vendor

Soplanning

Status
Soplanning
Vendor
CVE Published:
20 November 2025

What is CVE-2025-62731?

SOPlanning contains a Stored Cross-Site Scripting vulnerability that allows an attacker with access to the public holidays feature to inject arbitrary HTML and JavaScript code. This malicious code can be executed on multiple pages, posing a significant risk to user security and integrity. The vulnerability impacts those with administrative or special privileges accessing the affected /feries endpoint. The issue has been resolved in version 1.55.

Affected Version(s)

SOPlanning 0 < 1.55

References

https://cert.pl/en/posts/2025/11/CVE-2025-62293
third-party-advisory
https://www.soplanning.org/en/
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ɓukasz Jaworski (Pentest Limited)
JSON
.
CVE-2025-62731 : Stored XSS Vulnerability in SOPlanning by SOPlanning