CVE-2025-70368: XSS
Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in the Updates text field which is then rendered in the reporting view without proper sanitization. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability, and who is at risk from the payload?
An attacker needs at least low-level authenticated access to submit a Project Update containing a malicious payload. Users who later open the reporting view that renders the affected update may have JavaScript executed in their browser.
Does exploitation require user interaction?
Yes. The stored payload executes when a victim browses to the page containing the vulnerable Project Updates content in the reporting view.
What permissions does an attacker need?
The CVSS vector indicates low privileges are required. The attacker must be able to enter content in the Project Updates text field.