PatchTheCVEsoplanning vulnerabilities
Recent CVEs affecting soplanning products. 19 tracked.
soplanning has 19 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 16. Most recent: 2025-11-20. Highest priority: CVE-2024-27115 (score 62/100).
- CVE-2025-62294 HIGH 7.5 UPGRADE SOPlanning is vulnerable to Predictable Generation of Password Recovery Token
- CVE-2025-62730 HIGH 8.8 UPGRADE SOPlanning is vulnerable to Privilege Escalation in user management tab
- CVE-2025-41001 MEDIUM 5.4 DOWNGRADE Cross Site Scripting (XSS) vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a
- CVE-2025-62293 MEDIUM 5.4 UPGRADE SOPlanning is vulnerable to Broken Access Control in /status endpoint
- CVE-2025-62295 MEDIUM 5.4 UPGRADE SOPlanning is vulnerable to Stored XSS in /groupe_form endpoint
- CVE-2025-62296 MEDIUM 5.4 UPGRADE SOPlanning is vulnerable to Stored XSS in /taches endpoint
- CVE-2025-62297 MEDIUM 5.4 UPGRADE SOPlanning is vulnerable to Stored XSS in /projets endpoint
- CVE-2025-62729 MEDIUM 5.4 UPGRADE SOPlanning is vulnerable to Stored XSS in /status endpoint
- CVE-2025-62731 MEDIUM 4.8 UPGRADE SOPlanning is vulnerable to Stored XSS in /feries endpoint
- CVE-2024-9574 CRITICAL 9.8 UPGRADE SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, whi
- CVE-2024-9573 MEDIUM 6.3 UPGRADE SQL injection vulnerability in SOPlanning <1.45, through /soplanning/www/groupe_list.php, in the by parameter,
- CVE-2024-9572 MEDIUM 6.3 UPGRADE Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input v
- CVE-2024-9571 MEDIUM 6.3 UPGRADE Cross-Site Scripting (XSS) vulnerability in SOPlanning <1.45, due to lack of proper validation of user input v
- CVE-2024-57170 MEDIUM 6.5 DOWNGRADE SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php
- CVE-2024-57169 CRITICAL 9.8 DOWNGRADE A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php
- CVE-2024-27115 CRITICAL 9.8 UPGRADE A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool
- CVE-2024-27114 CRITICAL 9.8 UPGRADE A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool
- CVE-2024-27113 CRITICAL 9.8 UPGRADE An unauthenticated Insecure Direct Object Reference (IDOR) to the database has been found in the SO Planning t
- CVE-2024-27112 CRITICAL 9.8 UPGRADE A unauthenticated SQL Injection has been found in the SO Planning tool that occurs when the public view settin
FAQ
How do I fix soplanning vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is soplanning being exploited right now?
None of the tracked soplanning CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which soplanning CVE should I patch first?
CVE-2024-27115 currently ranks highest (62/100): A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool.