CVE-2025-58070
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.
Risk Assessment
The risk is the possibility of session theft, account takeover, or unauthorized actions in the context of the logged-in user.
Recommendation
Update Pleasanter to a version that includes a fix eliminating the XSS vulnerability in the attachment preview.
Other vulnerabilities in Pleasanter
See all- CVE-2026-113438Medium
Pleasanter fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete information stored in the product with the privilege of the account used to log in.
- CVE-2025-61931Medium
Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.
Original NVD description (English source)
Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's web browser.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS