WorkDo vulnerabilities
Published CVEs affecting WorkDo products: 5 record(s), with severity, exploitation and fixes.
CVE-2025-40978
Medium · 5.1
CWE-79 Jan 12, 2026
Multiple vulnerabilities in WorkDo products
Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request to ‘/ticket/x/conversion’, using the ‘reply_description’ parameter.
CVE-2025-40977
Medium · 5.1
CWE-79 Jan 12, 2026
Multiple vulnerabilities in WorkDo products
Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’, using the ‘subject’ and ‘description’ parameters.
CVE-2025-40976
Medium · 5.1
CWE-79 Jan 12, 2026
Multiple vulnerabilities in WorkDo products
Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ticketgo-saas/home’, using the ‘description’ parameter.
CVE-2025-40975
Medium · 5.1
CWE-79 Jan 12, 2026
Multiple vulnerabilities in WorkDo products
Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's HRMGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/hrmgo/ticket/changereply’, using the ‘description’ parameter.
CVE-2025-63294
Medium · 6.5
CWE-862 Nov 4, 2025
Missing Authorization in Workdo Hrm Saas
WorkDo HRM SaaS HR and Payroll Tool 8.1 is affected vulnerable to Insecure Permissions. An authenticated user can create leave or resignation records on behalf of other users.