Yüksek CVSS 8.1
CVE-2025-65778: Wekan: siteler arası betik çalıştırma (XSS)
Açıklama (NVD)
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft and CSRF actions.
Özet bilgiler
- Ürün
- Wekan Project Wekan
- CVSS v3.1
- 8.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - EPSS
- %0,38 (yüzdelik 32)
- CWE
- CWE-79
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| wekan-project-wekan | — | — | 8.16 |