CVE-2025-50183: falha de média gravidade em OpenListTeam OpenList
OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file preview/browsing feature of the application, where files with a .py extension that contain JavaScript code wrapped in <script> tags may be interpreted and executed as HTML in certain modes. This leads to a stored XSS vulnerability. This issue has been patched in version 4.0.0-rc.4.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Produtos afetados
OpenListTeam · OpenListCVEs relacionadas — OpenListTeam OpenList
No mesmo produto, das mais perigosas para as menos.
CVE-2026-75602MEDIUMOpenList: Authenticated arbitrary file write via Content-Disposition path traversal in SimpleHttp offline-download toolEPSS 0.7%CVE-2026-25059HIGHOpenList affected by Path Traversal in file copy and remove handlersEPSS 0.7%CVE-2026-73509HIGHOpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversalEPSS 0.5%CVE-2026-69160MEDIUMOpenList: Arbitrary File Read via Path Prefix Confusion in Share Creation APIEPSS 0.4%CVE-2026-102663MEDIUMOpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve SearchEPSS 0.3%CVE-2026-25060HIGHOpenList Insecure TLS Default ConfigurationEPSS 0.3%