CVE-2025-1420: Proget

Low severity, CVSS 2.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-privileged user to perform a Stored Cross-Site Scripting attack. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).

Affected products

• Proget Proget: before 2.17.5 (fixed in 2.17.5)

Published 2025-05-21. Last modified 2026-06-17.