Holded Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Holded application, specifically within the Activities functionality. This issue allows an attacker to inject and store a JavaScript payload in the editable 'name' and 'icon' fields. The vulnerability affects Holded, a cloud invoicing software for small and medium-sized businesses.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

The vulnerability was fixed on May 2, 2024. Users are advised to update to the latest version of Holded.