CVE-2025-55291

Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the </title> tag to be prematurely closed, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability is fixed in 0.15.0.

• CWE-79
• CWE-80
• CWE-87

• https://github.com/shaarli/Shaarli/commit/66faa61335a6e72184be64092ff1242ffa4fe5b6
• https://github.com/shaarli/Shaarli/security/advisories/GHSA-7w7w-pw4j-265h

Published

Aug 18, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55285@backstage/plugin-scaffolder-backend is the backend for the …2.6
• CVE-2025-55286z2d is a pure Zig 2D graphics library. z2d v0.7.0 released w…7.3
• CVE-2025-55287Genealogy is a family tree PHP application. Prior to 4.4.0, …5.4
• CVE-2025-55288Genealogy is a family tree PHP application. Prior to 4.4.0, …5.4
• CVE-2025-55289Chamilo is a learning management system. Prior to version 1.…9
• CVE-2025-5529The Educenter theme for WordPress is vulnerable to Stored Cr…6.4
• CVE-2025-55292Meshtastic is an open source mesh networking solution. In th…8.2
• CVE-2025-55293Meshtastic is an open source mesh networking solution. Prior…9.8
• CVE-2025-55294screenshot-desktop allows capturing a screenshot of your loc…9.8
• CVE-2025-55295qBit Manage is a tool that helps manage tedious tasks in qBi…6.5
• CVE-2025-55296librenms is a community-based GPL-licensed network monitorin…5.4
• CVE-2025-55297ESF-IDF is the Espressif Internet of Things (IOT) Developmen…8.8