CVE-2025-1076

A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality.

Score

CVSS 3.1 4.8 Medium

Status

Deferred - cve-coordination@incibe.es

Published

2025-02-06

Last modified

2025-02-13

Weaknesses

CWE-79

Affected products

• Holded (Holded)

References

• https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-vulnerability-holded