CVE-2024-4026: Holded

Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Cross-Site Scripting (XSS) vulnerability in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within all editable parameters within the 'General' and 'Team ID' functionalities, which could result in a session takeover.

Affected products

• Holded Holded: before 4.20.0 (fixed in 4.20.0)

Published 2024-04-22. Last modified 2026-06-17.