Cloudanix VulnDB

CVE-2025-67824

Medium · 6.1

CVSS

6.1

EPSS

0.2%

Published

Jan 20, 2026

CISA due date

—

The record

The WorklogPRO - Jira Timesheets plugin in the Jira Data Center before 4.24.2-jira9, 4.24.2-jira10 and 4.24.2-jira11 allows attackers to inject arbitrary HTML or JavaScript via XSS. This is exploited via a crafted payload placed in the name of a filter. This code is executed in the browser when the user attempts to create a timesheet with the filter timesheet type on the custom timesheet dialog because the filter name is not properly sanitized during the action.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities