CVE-2025-1076

Summary

CVE-2025-1076 is a newly discovered Stored Cross-Site Scripting (XSS) vulnerability affecting the Holded application. An attacker can exploit this flaw by injecting malicious JavaScript code into the editable 'name' and 'icon' parameters of the Activities functionality. Successful exploitation could lead to unintended execution of malicious scripts in users' browsers, potentially resulting in data theft or session hijacking. It is strongly recommended that Holded users update their applications to the latest version, which presumably includes a patch for this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.