CVE-2026-40544

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40544", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-04-14T09:44:27.613Z", "datePublished": "2026-06-01T09:03:49.850Z", "dateUpdated": "2026-06-01T13:06:47.877Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SOPlanning", "vendor": "SOPlanning", "versions": [{"lessThanOrEqual": "1.55", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "\u0141ukasz Jaworski"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via <i>/process/upload_backup</i> endpoint.&nbsp;An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious <i>user.csv</i> file with embedded JavaScript. The injected code is executed in the victim\u2019s browser when a user clicks the <i>Edit</i> button for the malicious backup.<br><br>This issue affects SOPlanning version 1.55 and below.<br>"}], "value": "SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint.\u00a0An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim\u2019s browser when a user clicks the Edit button for the malicious backup.\n\nThis issue affects SOPlanning version 1.55 and below."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-06-01T09:03:49.850Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2026/06/CVE-2026-40543"}, {"tags": ["product"], "url": "https://www.soplanning.org/en/"}], "source": {"discovery": "EXTERNAL"}, "title": "Stored XSS in SOPlanning", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-01T13:06:38.709925Z", "id": "CVE-2026-40544", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T13:06:47.877Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40544", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T13:06:38.709925Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-01T13:06:44.306Z"}}], "cna": {"title": "Stored XSS in SOPlanning", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "\u0141ukasz Jaworski"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SOPlanning", "product": "SOPlanning", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.55"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.pl/en/posts/2026/06/CVE-2026-40543", "tags": ["third-party-advisory"]}, {"url": "https://www.soplanning.org/en/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint.\u00a0An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim\u2019s browser when a user clicks the Edit button for the malicious backup.\n\nThis issue affects SOPlanning version 1.55 and below.", "supportingMedia": [{"type": "text/html", "value": "SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via <i>/process/upload_backup</i> endpoint.&nbsp;An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious <i>user.csv</i> file with embedded JavaScript. The injected code is executed in the victim\u2019s browser when a user clicks the <i>Edit</i> button for the malicious backup.<br><br>This issue affects SOPlanning version 1.55 and below.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-06-01T09:03:49.850Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40544", "state": "PUBLISHED", "dateUpdated": "2026-06-01T13:06:47.877Z", "dateReserved": "2026-04-14T09:44:27.613Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-06-01T09:03:49.850Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SOPlanning", "vendor": "SOPlanning", "versions": [{"lessThanOrEqual": "1.55", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint.\u00a0An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim\u2019s browser when a user clicks the Edit button for the malicious backup.\n\nThis issue affects SOPlanning version 1.55 and below."}, {"lang": "es", "value": "SOPlanning es vulnerable a Cross-Site Scripting Almacenado (XSS) a trav\u00e9s del endpoint /process/upload_backup. Un atacante autenticado con acceso a la funcionalidad de copia de seguridad puede subir un archivo ZIP manipulado que contiene un archivo user.csv malicioso con JavaScript incrustado. El c\u00f3digo inyectado se ejecuta en el navegador de la v\u00edctima cuando un usuario hace clic en el bot\u00f3n Editar para la copia de seguridad maliciosa.\n\nEste problema afecta a SOPlanning versi\u00f3n 1.55 y anteriores."}], "id": "CVE-2026-40544", "lastModified": "2026-07-22T07:10:00.107", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40544", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-01T13:06:38.709925Z", "version": "2.0.3"}}]}, "published": "2026-06-01T09:16:17.163", "references": [{"source": "cvd@cert.pl", "url": "https://cert.pl/en/posts/2026/06/CVE-2026-40543"}, {"source": "cvd@cert.pl", "url": "https://www.soplanning.org/en/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.55]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "SOPlanning", "source": "cna", "vendor": "SOPlanning"}, "product": "soplanning", "vendor": "soplanning"}], "created": "2026-06-01T10:30:25.824034+00:00", "updated": "2026-06-01T10:30:26.198680+00:00", "vendors": ["soplanning", "soplanning$PRODUCT$soplanning"]}