CVE-2025-57681

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. The vulnerability is exploited via a specially crafted payload placed in an issue's summary field

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jan 21, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-576826.5Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucketCVE-2025-576858.8The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, anCVE-2025-57696.1The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encodiCVE-2025-576926.8PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution ofCVE-2025-576976.5AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64. Since the _encode_image_bs64 function definCVE-2025-576987.5AstrBot Project v3.5.22 contains a directory traversal vulnerability. The handler function install_plugin_upload of the interface '/plugin/iCVE-2025-576998.4Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user wCVE-2025-57706.1A reflected cross-site scripting (XSS) vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of outpuCVE-2025-577006.1DIAEnergie - Stored Cross-site ScriptingCVE-2025-577016.1DIAEnergie - Reflected Cross-site ScriptingCVE-2025-577026.1DIAEnergie - Reflected Cross-site ScriptingCVE-2025-577036.1DIAEnergie - Reflected Cross-site Scripting