Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal Notes, Action Step Name, Action Step Description, Note Name, and Goal Description parameters. The patched version is PP-Release-6.3.2.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 21 Oct 2025 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Multiple stored cross-site scripting (XSS) vulnerabilities in the Future Goals function of HR Performance Solutions Performance Pro v3.19.17 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Goal Name, Goal Notes, Action Step Name, Action Step Description, Note Name, and Goal Description parameters. The patched version is PP-Release-6.3.2.0. | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published:
Updated: 2025-10-21T14:37:49.585Z
Reserved: 2025-09-26T00:00:00.000Z
Link: CVE-2025-60933
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-10-21T15:15:39.447
Modified: 2025-10-21T15:15:39.447
Link: CVE-2025-60933
Redhat
No data.
OpenCVE Enrichment
No data.