CoreCVE
Back

MEDIUM

Multiple vulnerabilities in WorkDo products

Published Jan 12, 2026

Description

Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ticketgo-saas/home’, using the ‘description’ parameter.

Affected products

Remediation

Vendor solution

No solution has been reported at this time.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner INCIBE
Published Jan 12, 2026
Updated Jan 12, 2026
Reserved Apr 16, 2025
Link CVE-2025-40976
CISA Vulnrichment
Updated Jan 12, 2026
NVD
Status Deferred
Modified Jun 17, 2026
Link CVE-2025-40976
Red Hat
Severity n/a
Public date n/a
Links CVE-2025-40976