CVE-2025-57292

Published
View on NVD ↗
CVSS v3
6.1
MEDIUM
CVSS v2
N/A
Affected
2
PROJECTS

Description

Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.

ASencerK/TodoistStoredXSS
ASencerK/TodoistStoredXSS
Discovered Stored XSS vulnerability on Todoist's platform through the avatar upload feature
GitHubGitHub
echoBRT/TodoistStoredXSS
echoBRT/TodoistStoredXSS
I discovered a Stored XSS vulnerability on Todoist's platform through the avatar upload feature
GitHubGitHub