CVE-2025-62798: falha de média gravidade em code16 sharp
Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.2%
Sharp is a content management framework built for Laravel as a package. Prior to 9.11.1, a Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component. In affected versions, expressions wrapped in {{ & }} were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed. The issue has been fixed in v9.11.1 .
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
code16 · sharpCVEs relacionadas — code16 sharp
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33686HIGHSharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtilEPSS 0.6%CVE-2026-33687HIGHSharp has Unrestricted File Upload via Client-Controlled Validation RulesEPSS 0.5%CVE-2026-44692HIGHAuthenticated Sharp users can download unrelated Laravel Storage objects through the generic download endpointEPSS 0.3%CVE-2026-61825HIGHcode16/sharp has a stored XSS via data-html-content Sanitizer BypassEPSS 0.2%CVE-2026-53634MEDIUMSharp: Missing Authorization Check in Quick Creation Command EndpointsEPSS 0.2%CVE-2026-61823HIGHcode16 Sharp vulnerable to stored XSS via iframe srcdoc AttributeEPSS 0.2%