CVE-2025-62528CWE-79cross-site-scripting

CVE-2025-62528

Medium · published October 21, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
6.9
In the wild
Unconfirmed
What it is

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00177 · 6.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-21T00:15Z
Affected products (1)
ProductVersionsFixed in
taguette/taguette< 1.5.01.5.0
References (2)
https://github.com/remram44/taguette/security/advisories/GHSA-g9qw-g6rv-3889 · [email protected]https://gitlab.com/remram44/taguette/-/issues/330 · [email protected]
EPSS history
Timeline
  • 20 OCT 20:03Z
    Taguette cross-site scripting vulnerability via tag name, tag description, document name and document description
    cvelistv5