CVE-2025-50977

A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1, requiring authenticated admin access for exploitation. The vulnerability exists in the 'r' parameter and allows attackers to inject malicious Angular expressions that execute JavaScript code in the context of the application. The flaw can be exploited through GET requests to the summary endpoint as well as POST requests to specific Wicket interface endpoints, though the GET method provides easier weaponization. This vulnerability enables authenticated administrators to execute arbitrary client-side code, potentially leading to session hijacking, data theft, or further privilege escalation attacks.

• CWE-79

• https://github.com/4rdr/proofs/blob/main/info/gitblit-v1.7.1-reflected-XSS-via-angularjs-expression.mdExploit, Third Party Advisory
• https://github.com/4rdr/proofs/blob/main/info/gitblit-v1.7.1-reflected-XSS-via-angularjs-expression.mdExploit, Third Party Advisory

Published

Aug 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-5097Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-50971Directory traversal vulnerability in AbanteCart version 1.4.…7.5
• CVE-2025-50972SQL Injection vulnerability in AbanteCart 1.4.2, allows unau…9.8
• CVE-2025-50974The Calamaris log exporter CGI (/cgi-bin/logs.cgi/calamaris.…6.5
• CVE-2025-50975IPFire 2.29 web-based firewall interface (firewall.cgi) fail…5.4
• CVE-2025-50976IPFire 2.29 DNS management interface (dns.cgi) fails to prop…6.1
• CVE-2025-50978In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vu…6.1
• CVE-2025-50979NodeBB v4.3.0 is vulnerable to SQL injection in its search-c…8.6
• CVE-2025-5098PrinterShare Android application allows the capture of Gmail…9.1
• CVE-2025-50983SQL Injection vulnerability exists in the sortKey parameter …8.3
• CVE-2025-50984diskover-web v2.3.0 Community Edition is vulnerable to multi…5.3
• CVE-2025-50985diskover-web v2.3.0 Community Edition is vulnerable to multi…5.6