{"id":72306,"date":"2025-10-24T23:47:38","date_gmt":"2025-10-24T20:17:38","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-62716-plane-vulnerable-to-cross-site-scripting-via-open-redirect-in-next_path-parameter\/"},"modified":"2025-10-24T23:47:38","modified_gmt":"2025-10-24T20:17:38","slug":"cve-2025-62716-plane-vulnerable-to-cross-site-scripting-via-open-redirect-in-next_path-parameter","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-62716-plane-vulnerable-to-cross-site-scripting-via-open-redirect-in-next_path-parameter\/","title":{"rendered":"CVE-2025-62716 &#8211; Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter"},"content":{"rendered":"<p>CVE ID : CVE-2025-62716<\/p>\n<p>Published :  Oct. 24, 2025, 8:17 p.m. | 26\u00a0minutes ago<\/p>\n<p>Description : Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting (XSS) vulnerability, enabling attackers to execute arbitrary JavaScript in the victim\u2019s browser. The issue can be exploited without authentication and has severe impact, including information disclosure, and privilege escalation and modifications of administrative settings. This issue has been patched in version 1.1.0.<\/p>\n<p>Severity: 8.1 | HIGH<\/p>\n<p>Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2025-62716 Published : Oct. 24, 2025, 8:17 p.m. | 26\u00a0minutes ago Description : Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-72306","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/72306","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=72306"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/72306\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=72306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=72306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=72306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}