CVE-2025-6078: CVE-2025-6078

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-02 · updated 2026-06-17

Description

Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input, making it possible to add notes with HTML tags and JavaScript, enabling an attacker to add a note containing malicious JavaScript, leading to stored XSS (cross-site scripting).

Affected products

Partner Software Partner Web: from 4.32 before 4.32.2 — fixed in 4.32.2

How to fix

Upgrade to a fixed version: Partner Software Partner Web 4.32.2. Check the vendor advisory for mitigations.

References

https://partnersoftware.com/resources/software-release-info-4-32/
https://kb.cert.org/vuls/id/317469
https://www.kb.cert.org/vuls/id/317469

Get alerted when CVE-2025-6078 or the next vulnerability affects your stack