CVE-2025-40975 - Multiple vulnerabilities in WorkDo products

Back Back to CVE browser

MEDIUM

Multiple vulnerabilities in WorkDo products

Published Jan 12, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.27%

Description

Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's HRMGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/hrmgo/ticket/changereply’, using the ‘description’ parameter.

Affected products

Vendor WorkDo Product HRMGo Default
unaffected
Affected
- All versions

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
WorkDo	HRMGo	unaffected	Affected All versions

Remediation

Vendor solution

No solution has been reported at this time.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-1941		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-workdo-products

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner INCIBE

Published Jan 12, 2026

Updated Jan 12, 2026

Reserved Apr 16, 2025

Link CVE-2025-40975

CISA Vulnrichment

Updated Jan 12, 2026

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-40975

Red Hat

No data

ENISA EUVD

Assigner INCIBE

Published Jan 12, 2026

Updated Jan 12, 2026

Link EUVD-2026-1941

GitHub

No data