CVE-2025-53838

LinkAce is a self-hosted archive to collect website links. A stored cross-site scripting (XSS) vulnerability was discovered in versions prior to 2.1.9 that allows an attacker to inject arbitrary JavaScript, which is then executed in the context of a user's browser when the malicious link is clicked. This is a one-click XSS, meaning the victim only needs to click a crafted link — no further interaction is required. The application contains a stored XSS vulnerability due to insufficient filtering and escaping of user-supplied data inserted into link attributes. Malicious JavaScript code can be saved in the database along with the link and executed in the user’s browser when clicking the link, leading to arbitrary script execution within the context of the site. Version 2.1.9 fixes the issue.

• CWE-79

• https://github.com/Kovah/LinkAce/commit/4da467a4b0fbb1650670e603f4449b8a47695631Patch
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-vwmx-v9qf-q656Exploit, Vendor Advisory
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-vwmx-v9qf-q656Exploit, Vendor Advisory

Published

Sep 8, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53831DrawIO for ownCloud is an application for using DrawIO with …8.2
• CVE-2025-53832Lara Translate MCP Server is a Model Context Protocol (MCP) …7.5
• CVE-2025-53833LaRecipe is an application that allows users to create docum…10
• CVE-2025-53834Caido is a web security auditing toolkit. A reflected cross-…6.3
• CVE-2025-53835XWiki Rendering is a generic rendering system that converts …9
• CVE-2025-53836XWiki Rendering is a generic rendering system that converts …8.8
• CVE-2025-53839DRACOON is a file sharing service, and the DRACOON Branding …4
• CVE-2025-5384A vulnerability was found in JeeWMS up to 20250504. It has b…9.8
• CVE-2025-53840Icinga DB Web provides a graphical interface for Icinga moni…2.4
• CVE-2025-53841The GC-AGENTS-SERVICE running as part of Akamai´s Guardicore…7.8
• CVE-2025-53842Use of hard-coded credentials issue exists in ZWX-2000CSW2-H…6.8
• CVE-2025-53843A stack-based buffer overflow vulnerability in Fortinet Fort…7.5