EUVD-2026-58471
GHSA-wf5q-9pcr-hqpg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Administrator credentials required to inject (PR:H); scope changes because victim users' sessions are compromised; no availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Worksuite SaaS versions prior to 6.0.14 contains a stored cross-site scripting vulnerability in the Asset Management module that allows authenticated administrators to inject arbitrary JavaScript by entering malicious payloads into the Location and Description fields when creating a new asset. Attackers can store crafted HTML script tags in the application database that execute automatically in the browsers of any user who views the affected asset, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.
AnalysisAI
Stored cross-site scripting in Worksuite SaaS Asset Management allows authenticated administrators to persist arbitrary JavaScript into the application database via the Location and Description fields of the asset creation form. All users who subsequently view an affected asset - regardless of their own privilege level - will execute the injected script in their browser, enabling session hijacking, credential theft, and unauthorized actions performed within their authenticated session context. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 4.6 (Medium) reflects the high-privilege prerequisite that meaningfully constrains the attack surface.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation) describes this root cause class: user-supplied input stored in a backend database is later rendered in HTML responses without adequate output encoding or content-security-policy controls. The affected product is identified by CPE cpe:2.3:a:froiden:worksuite_saas:*:*:*:*:*:*:*:*, indicating the Worksuite SaaS platform developed by Froiden, a commercial project management and HR SaaS application. The vulnerability is localized to the Asset Management module, specifically the asset creation workflow. Stored XSS is more severe than reflected XSS because the payload persists across sessions and does not require the attacker to deliver a crafted URL to each victim - any user navigating to the affected asset page triggers execution automatically.
RemediationAI
Upgrade Worksuite SaaS to version 6.0.14 or later, which resolves the stored XSS vulnerability in the Asset Management module per the CVE description. The vendor product site is https://worksuite.biz/ and the VulnCheck advisory at https://www.vulncheck.com/advisories/worksuite-saas-version-prior-to-stored-xss-via-asset-management-location-and-description-fields should be monitored for patch confirmation. If immediate upgrade is not feasible, restrict Asset Management write access to the minimum number of trusted administrator accounts to reduce the likelihood of exploitation; note that this does not eliminate the vulnerability and only raises the bar for an attacker who already holds administrator credentials. Deploying a Content Security Policy (CSP) header that disallows inline script execution would serve as an effective compensating control that neutralizes stored XSS payloads without requiring application changes, though misconfigurations in CSP policy can reduce coverage.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today