Vulnerability · Published Feb 22, 2025 · Assigned by VulDB
CVE-2025-1553pankajindevops scale project cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in scale from pankajindevops. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Official description
A vulnerability was found in pankajindevops scale up to 3633544a00245d3df88b6d13d9b3dd0f411be7f6. It has been classified as problematic. Affected is an unknown function of the file /scale/project. The manipulation of the argument goal leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| pankajindevops | scale | 3633544a00245d3df88b6d13d9b3dd0f411be7f6 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- VDB-296502 | pankajindevops scale project cross site scripting vdb-entry, technical-description
- VDB-296502 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #491216 | https://github.com/pankajindevops/scale Scale latest Stored Cross Site Scripting third-party-advisory
- https://docs.google.com/document/d/1r8Ad7Kaw0bwKZMVFDlhzhpjdque7vRGTDKDeP7yiUEc related
- https://drive.google.com/file/d/1CRdzTf2bPEB7MshIighYYcVL3IbArBPr/view exploit
- https://docs.google.com/document/d/1r8Ad7Kaw0bwKZMVFDlhzhpjdque7vRGTDKDeP7yiUEc/edit?tab=t.0#heading=h.ukpd7mmeqiqp exploit