https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:03:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-357037 EUVD-2026-357037 https://cve.radiocsirt.org/vuln/euvd-2026-357037 https://cve.radiocsirt.org/vuln/fkie_cve-2026-50190 <p>Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark-&gt;getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `&lt;title&gt;` element without HTML escaping. A bookmark title containing `&lt;/title&gt;&lt;script&gt;...&lt;/script&gt;` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli&#39;s metadata fetcher copies a remote page&#39;s `&lt;title&gt;` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.</p> <p>Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark-&gt;getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `&lt;title&gt;` element without HTML escaping. A bookmark title containing `&lt;/title&gt;&lt;script&gt;...&lt;/script&gt;` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli&#39;s metadata fetcher copies a remote page&#39;s `&lt;title&gt;` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-50190 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50190 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: shaarli</p> <p>Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark-&gt;getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `&lt;title&gt;` element without HTML escaping. A bookmark title containing `&lt;/title&gt;&lt;script&gt;...&lt;/script&gt;` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli&#39;s metadata fetcher copies a remote page&#39;s `&lt;title&gt;` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: shaarli</p> <p>Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark-&gt;getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `&lt;title&gt;` element without HTML escaping. A bookmark title containing `&lt;/title&gt;&lt;script&gt;...&lt;/script&gt;` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli&#39;s metadata fetcher copies a remote page&#39;s `&lt;title&gt;` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-50190