CVE-2025-62528
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0.
Risk Assessment
A project member can inject malicious JavaScript that executes in the browsers of other users opening the project, potentially leading to session or data theft.
Recommendation
Update Taguette to version 1.5.0 or later.
Other vulnerabilities in Taguette
See all- CVE-2025-67502Medium
Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.
- CVE-2025-62527High
Taguette is an open source qualitative research tool. An issue has been discovered in versions prior to 1.5.0 where an attacker could request a password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This has been patched in version 1.5.0.
Original NVD description (English source)
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS