CVE-2025-61931

MediumCVSS 5.4

Published: 24/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.

Risk Assessment

This may lead to user session compromise or execution of unauthorized actions in the user's context.

Recommendation

Update Pleasanter to a patched version and enforce input sanitization in the Body, Description and Comments fields.

Other vulnerabilities in Pleasanter

CVE-2025-58070Medium
Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.

Original NVD description (English source)

Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS