Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-65922

Quick assessment

Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Planka是Planka开源的一个使用 React 和 Redux 构建的类似 Trello 的看板。 Planka 2.0.0版本存在安全漏洞，该漏洞源于缺少X-Frame-Options和CSP frame-ancestors标头，可能导致钓鱼攻击。

AI Predicted 3.5 Difficulty: Easy EPSS 0.14% · P4
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-65922

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead to unintended modification of projects or tasks, it exposes users to Phishing attacks. Attackers can frame the legitimate Planka application on a malicious site to establish false trust (UI Redressing), potentially tricking users into entering sensitive information or credentials into overlaid fake forms. NOTE: this is disputed by the Supplier because "PLANKA uses SameSite=Strict cookies, preventing authentication in cross-origin contexts. No session can be established. No credential interception or unauthorized actions are possible. Browser Same-Origin Policy prevents the parent page from accessing iframe content. Clickjacking is not applicable on the login page. Any credential capture would require attacker-controlled input and user interaction equivalent to phishing. The security outcome depends entirely on the user's trust in the parent page. An attacker can achieve the same effect with a fully fake login page. Embedding the legitimate page adds no risk, as browsers do not show URL, certificate, or padlock indicators in cross-origin iframes."
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Planka 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Planka是Planka开源的一个使用 React 和 Redux 构建的类似 Trello 的看板。 Planka 2.0.0版本存在安全漏洞，该漏洞源于缺少X-Frame-Options和CSP frame-ancestors标头，可能导致钓鱼攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2025-65922

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-65922

请登录查看更多情报信息。

Other References for CVE-2025-65922 (2)

Same Patch Batch · n/a · 2026-01-05 · 17 CVEs total

CVE-2025-15453 6.3 MEDIUM milvus HTTP Endpoint expr.go expr.Exec deserialization
CVE-2025-53966 SAMSUNG Mobile Processor 安全漏洞
CVE-2025-52517 SAMSUNG多款产品 安全漏洞
CVE-2025-52515 SAMSUNG多款产品 安全漏洞
CVE-2025-52519 SAMSUNG多款产品 安全漏洞
CVE-2025-52516 SAMSUNG多款产品 安全漏洞
CVE-2025-43706 SAMSUNG多款产品 安全漏洞
CVE-2025-67316 realme Internet Browser 安全漏洞
CVE-2025-67419 EverShop 安全漏洞
CVE-2025-67427 EverShop 安全漏洞
CVE-2025-67397 Passy 安全漏洞
CVE-2025-67303 ComfyUI-Manager 安全漏洞
CVE-2025-27807 SAMSUNG多款产品 安全漏洞
CVE-2025-49495 SAMSUNG Mobile Processor 安全漏洞
CVE-2025-57836 SAMSUNG Magician 安全漏洞
CVE-2025-65328 Devy Mega-Fence 安全漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2025-65922

No comments yet

Leave a comment