CVE Daily

CVE-2025-6078

Partner Software's Partner Software application and Partner Web application allo...

Medium CVSS 5.4

Overview

Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note containing malicious JavaScript, leading to stored XSS (cross-site scripting).

CWE: N/A Published: 2025-08-02T03:15:24.440
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 5.4 (MEDIUM)
  • Detected tags: stored_xss, xss (tag impact: MODERATE)

Recommended actions:

  • Sanitize stored input and enforce CSP.
  • Apply context-aware output encoding.
  • Enable Content-Security-Policy and HttpOnly/SameSite cookies.

Recommended tools

Tags