CVE-2026-40545

SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue affects SOPlanning version 1.55 and below.

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2026/06/CVE-2026-40543
https://www.soplanning.org/en/

Configurations

No configuration.

History

22 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) SOPlanning es vulnerable a XSS Reflejado a través del parámetro taches. Un atacante puede crear una URL maliciosa que, al ser abierta por una víctima autenticada, resulta en la ejecución arbitraria de JavaScript en el navegador de la víctima. Este problema afecta a SOPlanning versión 1.55 y anteriores.

01 Jun 2026, 09:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-01 09:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-40545

Mitre link : CVE-2026-40545

CVE.ORG link : CVE-2026-40545

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-40545", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40545", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T13:02:58.324531Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "SOPlanning", "product": "SOPlanning", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.55"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-01T09:16:17.287", "references": [{"url": "https://cert.pl/en/posts/2026/06/CVE-2026-40543", "source": "cvd@cert.pl"}, {"url": "https://www.soplanning.org/en/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim\u2019s browser.\n\nThis issue affects SOPlanning version 1.55 and below."}, {"lang": "es", "value": "SOPlanning es vulnerable a XSS Reflejado a trav\u00e9s del par\u00e1metro taches. Un atacante puede crear una URL maliciosa que, al ser abierta por una v\u00edctima autenticada, resulta en la ejecuci\u00f3n arbitraria de JavaScript en el navegador de la v\u00edctima.\n\nEste problema afecta a SOPlanning versi\u00f3n 1.55 y anteriores."}], "lastModified": "2026-07-22T07:10:00.107", "sourceIdentifier": "cvd@cert.pl"}