CVE Explorer

CVE-2025-62716

Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting (XSS) vulnerability, enabling attackers to execute arbitrary JavaScript in the victim’s browser. The issue can be exploited without authentication and has severe impact, including information disclosure, and privileg

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:90f806932102e76b1238283b574b59d951966a0f044a507a1fb87ef7e9d1f259

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:dec84657dfa5399efad74689336ecf40e7506953612360538eb6e44d8e53cef1 · sha256:79108472100f0e7b… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-601","description":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:dec84657dfa5399efad74689336ecf40e7506953612360538eb6e44d8e53cef1 · sha256:79108472100f0e7b… · /containers/cna/problemTypes/1/descriptions/0

Affected products and versions

1 source assertion

{"product":"plane","vendor":"makeplane","versions":[{"status":"affected","version":"< 1.1.0"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:dec84657dfa5399efad74689336ecf40e7506953612360538eb6e44d8e53cef1 · sha256:79108472100f0e7b… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:dec84657dfa5399efad74689336ecf40e7506953612360538eb6e44d8e53cef1 · sha256:79108472100f0e7b… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:dec84657dfa5399efad74689336ecf40e7506953612360538eb6e44d8e53cef1 · sha256:79108472100f0e7b… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-601","description":"CWE-601: URL Redirection to Untrusted Site ('Open Redirect')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:dec84657dfa5399efad74689336ecf40e7506953612360538eb6e44d8e53cef1 · sha256:79108472100f0e7b… · /containers/cna/problemTypes/1/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/makeplane/plane/security/advisories/GHSA-6fj7-xgpg-mj6f","tags":["x_refsource_CONFIRM"],"url":"https://github.com/makeplane/plane/security/advisories/GHSA-6fj7-xgpg-mj6f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:dec84657dfa5399efad74689336ecf40e7506953612360538eb6e44d8e53cef1 · sha256:79108472100f0e7b… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer