CVE-2025-62293

MediumCVSS 5.4/10Last modified Oct 19, 2026

Description

SOPlanning is vulnerable to Broken Access Control in /status endpoint. Due to lack of permission checks in Project Status functionality an authenticated attacker is able to add, edit and delete any status.

This issue was fixed in version 1.55.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Nov 20, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-622947.5SOPlanning is vulnerable to Predictable Generation of Password Recovery Token. Due to weak mechanism of generating recovery tokens, a malici CVE-2025-622955.4SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS CVE-2025-622965.4SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into CVE-2025-622975.4SOPlanning is vulnerable to Stored XSS in /projets endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into CVE-2025-622996.6HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with CVE-2025-62305.3A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execu CVE-2025-623005.9HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource CVE-2025-623055.1HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended d CVE-2025-623065.0HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of CVE-2025-623075.4HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack dete CVE-2025-623085.1HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could re CVE-2025-623092.6HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive info