Exploit for CVE-2025-70368

## https://sploitus.com/exploit?id=8A836B6C-0793-5AAA-827F-A97613AEE7D4
# CVE-2025-70368
# Stored Cross-Site Scripting (XSS) in Project Updates Feature

  
    
      
        
      
    
    
      Worklenz
      All in one project management tool for efficient teams 
    
  
  
  


## 📜 Description
Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in the Updates text field which is then rendered in the reporting view without proper sanitization. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field.

## 🔍 Affected Versions

| Status       | Version         |
|--------------|-----------------|
| 🔴 Vulnerable |   `2.1.5`      | 

## 🛠️ Steps to Reproduce

#### 1️⃣ Navigate to Projects --> "Project Name" --> Updates

#### 2️⃣ Enter the following payload:

```html

```


#### 3️⃣ Navigate to Reporting --> Projects

#### 4️⃣ The stored payload is rendered, and the alert executes:



## ⚠️ Disclaimer
This project is intended for **educational and ethical research purposes only**. Unauthorized testing on systems without explicit permission is illegal. Use responsibly and only on systems you own or have permission to test.

## 🧑‍💻 Discovery

This vulnerability was discovered by **Alex Perrakis** (Stolichnayer).

## 🔗 References:
- [Worklenzs Github Repository](https://github.com/Worklenz/worklenz)