CVE-2025-55291: fallo de gravedad alta en Shaarli
Shaarli allows reflected XSS via searchtags parameter
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.2%
probabilidad de explotación
0.2%top 87% de las CVE
explotación observada
noninguna fuente lo reporta
Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the </title> tag to be prematurely closed, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability is fixed in 0.15.0.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Productos afectados
shaarli · ShaarliCVEs relacionadas — Shaarli
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-50190HIGHShaarli vulnerable to stored XSS via raw bookmark title in document <title> element on public permalink pageEPSS 0.4%CVE-2026-48821MEDIUMShaarli: DOM-based Cross-Site Scripting (XSS) in Thumbnail SynchronizerEPSS 0.2%CVE-2026-24476MEDIUMShaarli vulnerable to stored XSS via Suggested TagsEPSS 0.2%CVE-2026-48822MEDIUMShaarli has Stored Cross-Site Scripting (XSS) via Markdown Reference LinksEPSS 0.2%CVE-2026-48823MEDIUMShaarli has Stored Cross-Site Scripting (XSS) via Tags SearchEPSS 0.2%