CVE-2025-55291

{"id": "CVE-2025-55291", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.8}]}, "published": "2025-08-18T17:15:31.243", "references": [{"url": "https://github.com/shaarli/Shaarli/commit/66faa61335a6e72184be64092ff1242ffa4fe5b6", "source": "security-advisories@github.com"}, {"url": "https://github.com/shaarli/Shaarli/security/advisories/GHSA-7w7w-pw4j-265h", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}, {"lang": "en", "value": "CWE-87"}]}], "descriptions": [{"lang": "en", "value": "Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the </title> tag to be prematurely closed, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability is fixed in 0.15.0."}, {"lang": "es", "value": "Shaarli es un gestor de marcadores minimalista y un servicio para compartir enlaces. Antes de la versi\u00f3n 0.15.0, la cadena de entrada en la p\u00e1gina de etiquetas en la nube no se depuraba correctamente. Esto permit\u00eda que la etiqueta se cerrara prematuramente, lo que provocaba una vulnerabilidad de Cross-Site Scripting (XSS) Reflejado. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.15.0."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security-advisories@github.com"}