EUVD-2026-25869Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable stored XSS requiring authenticated submission (PR:L), victim browser interaction (UI:R), scope change to browser context (S:C), limited confidentiality and integrity impact; no server-side impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionCVE.org
ProjeQtor versions 7.0 through 12.4.3 contain a stored cross-site scripting vulnerability in the checkValidHtmlText() function within Security.php that fails to properly sanitize user input by only detecting specific patterns while returning unsanitized strings without output encoding. Attackers can inject malicious payloads that bypass the filter using alternative syntax such as img tags with event handlers, which are stored and executed in the browsers of users viewing the affected content.
AnalysisAI
Stored cross-site scripting in ProjeQtor 7.0 through 12.4.3 enables authenticated users to inject persistent malicious HTML payloads that execute in the browsers of other users viewing the affected content. The root cause is an incomplete pattern-based allowlist in the checkValidHtmlText() function within Security.php, which detects only specific dangerous constructs and returns unsanitized input without output encoding, allowing bypass via alternative syntax such as <img> tags with event handlers. No active exploitation has been confirmed in CISA KEV; however, a public proof-of-concept is available per VulnCheck, and EPSS at 0.03% (9th percentile) indicates low current automated exploitation activity.
Technical ContextAI
ProjeQtor is a PHP-based open-source project management application. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation) and manifests in Security.php within the checkValidHtmlText() function, which employs a blocklist-style pattern-detection approach rather than a strict allowlist or context-aware output encoding. When user-submitted input does not match the targeted dangerous patterns, the function returns the raw, unencoded string directly to the rendering layer, enabling stored payloads to persist and execute in victim browsers. CPE cpe:2.3:a:projeqtor:projeqtor:*:*:*:*:*:*:*:* spans all affected versions from 7.0 to 12.4.3. The bypass technique specifically leverages HTML elements such as <img> with onerror or similar event-handler attributes, which the filter does not enumerate.
RemediationAI
Upgrade ProjeQtor to a version released after 12.4.3 once a vendor-patched build is available; no specific fixed version number has been confirmed in the available data at time of analysis, and administrators should verify the current release status directly at https://www.projeqtor.com before planning upgrades. As an immediate compensating control, restrict or disable rich HTML input capabilities for low-privileged or untrusted user roles within ProjeQtor - reducing the set of users who can submit content to checkValidHtmlText()-processed fields directly limits the attacker pool, though this may restrict legitimate formatting features. Deploying a strict Content Security Policy (CSP) header that disallows inline script execution (e.g., script-src 'self') on the ProjeQtor web server would prevent injected event-handler payloads from executing even if stored, though this requires compatibility testing with ProjeQtor's own JavaScript. Network-layer WAF rules targeting onerror, onload, and similar HTML event-handler patterns in POST bodies can provide an additional detection layer but should not be treated as a primary control given the ease of encoding bypass.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today