CVE-2025-58070

MediumCVSS 6.1

Published: 24/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.

Risk Assessment

The risk is the possibility of session theft, account takeover, or unauthorized actions in the context of the logged-in user.

Recommendation

Update Pleasanter to a version that includes a fix eliminating the XSS vulnerability in the attachment preview.

Other vulnerabilities in Pleasanter

CVE-2025-61931Medium
Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.

Original NVD description (English source)

Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS