CVE-2024-4026: Cross-Site Scripting in the Holded application

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-22 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-Site Scripting (XSS) vulnerability in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within all editable parameters within the 'General' and 'Team ID' functionalities, which could result in a session takeover.

Affected products

Holded: before 4.20.0 — fixed in 4.20.0

How to fix

Upgrade to a fixed version: Holded 4.20.0. Check the vendor advisory for mitigations.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-holded-application
https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-holded-application

Get alerted when CVE-2024-4026 or the next vulnerability affects your stack