Golang CVE-2025-40977

Cross-site Scripting (XSS) (CWE-79)

2026-01-12 cve-coordination@incibe.es

XSS Golang

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 12, 2026 - 12:16 nvd

N/A

DescriptionNVD

Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, using the ‘subject’ and ‘description’ parameters.

Analysis

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, using the ‘subject’ and ‘description’ parameters.

Affected ProductsAI

Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POS

RemediationAI

Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers.

CVE-2025-40977 vulnerability details – vuln.today

Back