https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 29 Aug 2026 10:48:03 +0000 https://vulnerability.circl.lu/sighting/4109f30c-9e72-4757-8501-ce7869def764/export {"uuid": "4109f30c-9e72-4757-8501-ce7869def764", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29184", "type": "seen", "source": "https://gist.github.com/momenbasel/b291d38d428104862f2cb1870dce321c", "content": "# CVE-2020-29184: Stored Cross-Site Scripting in SOPlanning 1.47.01\n\n- **CVE ID:** CVE-2020-29184\n- **Status:** RESERVED (assigned by MITRE 2021-02-18, Service Request 988785)\n- **Affected product:** SOPlanning (Simple Online Planning) 1.47.01\n- **Vulnerability class:** Stored Cross-Site Scripting (CWE-79)\n- **Privileges required:** Authenticated user (any account able to create a task)\n- **Reporter:** Mo'men Basel\n- **Vendor:** SOPlanning \u2014 https://www.soplanning.org/\n\n## Summary\n\nSOPlanning 1.47.01 stores the task name without output encoding. A user who can\ncreate a task can put script in the task name; the payload executes for every user\nwho loads the planning view or the audit log.\n\n## Affected components\n\n- `/soplanning-1-47-01/soplanning/www/planning.php`\n- `/soplanning-1-47-01/soplanning/www/audit.php`\n\nBoth render the stored task name into the page without escaping it.\n\n## Reproduction\n\n1. Install SOPlanning 1.47.01.\n2. Register an account, or log in with any account permitted to create tasks.\n3. Create a task and set its **name** to a JavaScript payload.\n4. Open `/soplanning/www/planning.php`. The payload executes.\n5. Open `/soplanning/www/audit.php`. The payload executes there too.\n\nThe task name is reflected into both views without output encoding. No special\npayload construction is required beyond a standard script tag or event handler.\n\n\n## Impact\n\nThe payload is stored, so it fires for any user who opens the planning or audit\nview \u2014 including administrators. In an application whose whole purpose is shared\nteam scheduling, that is effectively guaranteed. An attacker with the lowest\ntask-creating privilege can run script in an administrator's session and act as\nthem.\n\n## Relationship to other SOPlanning issues\n\nThis is not the same issue as the following, which affect different versions or\ndifferent input fields:\n\n- CVE-2020-13963 \u2014 authentication bypass\n- Persistent XSS in 1.46.01 via Project Name, Statutes Comment, Places Comment,\n Resources Comment\n- XSS below 1.45 via `/soplanning/www/process/xajax_server.php`\n- Pentest Limited's XSS-to-account-takeover research against 1.47.00\n- CVE-2024-9571, CVE-2024-9572 \u2014 XSS in later releases\n\nThe vector here is the **task name field in 1.47.01**, rendered by `planning.php`\nand `audit.php`.\n\n## Timeline\n\n| Date | Event |\n|---|---|\n| 2020-11-17 | Reported to MITRE (Service Request 988785) |\n| 2021-02-18 | CVE-2020-29184 assigned, held RESERVED pending a public reference |\n| 2023-11-05 | Status requested |\n| 2024-06-24 | Status requested |\n| 2026-08-27 | This advisory published as the public reference |\n\n## Credit\n\nMo'men Basel\n", "creation_timestamp": "2026-08-27T12:19:26.936163Z"} {"uuid": "4109f30c-9e72-4757-8501-ce7869def764", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-29184", "type": "seen", "source": "https://gist.github.com/momenbasel/b291d38d428104862f2cb1870dce321c", "content": "# CVE-2020-29184: Stored Cross-Site Scripting in SOPlanning 1.47.01\n\n- **CVE ID:** CVE-2020-29184\n- **Status:** RESERVED (assigned by MITRE 2021-02-18, Service Request 988785)\n- **Affected product:** SOPlanning (Simple Online Planning) 1.47.01\n- **Vulnerability class:** Stored Cross-Site Scripting (CWE-79)\n- **Privileges required:** Authenticated user (any account able to create a task)\n- **Reporter:** Mo'men Basel\n- **Vendor:** SOPlanning \u2014 https://www.soplanning.org/\n\n## Summary\n\nSOPlanning 1.47.01 stores the task name without output encoding. A user who can\ncreate a task can put script in the task name; the payload executes for every user\nwho loads the planning view or the audit log.\n\n## Affected components\n\n- `/soplanning-1-47-01/soplanning/www/planning.php`\n- `/soplanning-1-47-01/soplanning/www/audit.php`\n\nBoth render the stored task name into the page without escaping it.\n\n## Reproduction\n\n1. Install SOPlanning 1.47.01.\n2. Register an account, or log in with any account permitted to create tasks.\n3. Create a task and set its **name** to a JavaScript payload.\n4. Open `/soplanning/www/planning.php`. The payload executes.\n5. Open `/soplanning/www/audit.php`. The payload executes there too.\n\nThe task name is reflected into both views without output encoding. No special\npayload construction is required beyond a standard script tag or event handler.\n\n\n## Impact\n\nThe payload is stored, so it fires for any user who opens the planning or audit\nview \u2014 including administrators. In an application whose whole purpose is shared\nteam scheduling, that is effectively guaranteed. An attacker with the lowest\ntask-creating privilege can run script in an administrator's session and act as\nthem.\n\n## Relationship to other SOPlanning issues\n\nThis is not the same issue as the following, which affect different versions or\ndifferent input fields:\n\n- CVE-2020-13963 \u2014 authentication bypass\n- Persistent XSS in 1.46.01 via Project Name, Statutes Comment, Places Comment,\n Resources Comment\n- XSS below 1.45 via `/soplanning/www/process/xajax_server.php`\n- Pentest Limited's XSS-to-account-takeover research against 1.47.00\n- CVE-2024-9571, CVE-2024-9572 \u2014 XSS in later releases\n\nThe vector here is the **task name field in 1.47.01**, rendered by `planning.php`\nand `audit.php`.\n\n## Timeline\n\n| Date | Event |\n|---|---|\n| 2020-11-17 | Reported to MITRE (Service Request 988785) |\n| 2021-02-18 | CVE-2020-29184 assigned, held RESERVED pending a public reference |\n| 2023-11-05 | Status requested |\n| 2024-06-24 | Status requested |\n| 2026-08-27 | This advisory published as the public reference |\n\n## Credit\n\nMo'men Basel\n", "creation_timestamp": "2026-08-27T12:19:26.936163Z"} https://vulnerability.circl.lu/sighting/4109f30c-9e72-4757-8501-ce7869def764/export Thu, 27 Aug 2026 12:19:26 +0000