Login Request a demo
Medium severity · published Jan 20, 2026
CVE-2025-40679
HTML injection in Isshue from Bdtask
5.1
CVSS
0.3%
EPSS
No
On KEV
Description
HTML Injection vulnerability in Isshue by Bdtask, consisting os an HTML injection due to a lack os proper validation of user input by sending a POST request to '/category_product_search', affecting the 'product_name' parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IS
Isshue · Bdtask
all versions · source: vendor
Affected product
IS
Isshue
Bdtask
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40679
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40679
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/html-injection-isshue-bdtask
More from Isshue
7.5
CVE-2025-13239
Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution submit_checkout behavioral workflow
5.4
CVE-2025-13186
Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting
4.8
CVE-2021-47769
Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS)