CVE-2025-52203: Devaslanphp Project Management

High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are subsequently stored in the database. When a legitimate user logs in and is redirected to the Dashboard panel "automatically upon authentication the malicious script executes in the user's browser context.

Affected products

• Devaslanphp Project Management: version 1.2.4 only

Published 2025-07-31. Last modified 2026-06-17.