CVE-2025-59424

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker can set a malicious JavaScript payload as their username. When an action performed by this user is recorded (e.g., generate or revoke an API token), the payload is stored in the database. The script is then executed in the browser of any user, particularly administrators, who views the /system/audit page. This vulnerability is fixed in 2.3.1.

• CWE-79

• https://github.com/Kovah/LinkAce/commit/c0d21b974b32f1ca2fab550fb476c573a068e196Patch
• https://github.com/Kovah/LinkAce/security/advisories/GHSA-289g-9gff-p4whExploit, Vendor Advisory

Published

Sep 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59418BunnyPad is a note taking software. Prior to version 11.0.27…5.5
• CVE-2025-59419Netty is an asynchronous, event-driven network application f…5.5
• CVE-2025-5942Netskope was notified about a potential gap in its agent (NS…5.7
• CVE-2025-59420Authlib is a Python library which builds OAuth and OpenID Co…7.5
• CVE-2025-59421Press, a Frappe custom app that runs Frappe Cloud, manages i…2.7
• CVE-2025-59422Dify is an open-source LLM app development platform. In vers…3.1
• CVE-2025-59425vLLM is an inference and serving engine for large language m…7.5
• CVE-2025-59426Lobe Chat is an open-source artificial intelligence chat fra…4.3
• CVE-2025-59427The Cloudflare Vite plugin enables a full-featured integrati…2.9
• CVE-2025-59428EspoCRM is an open source customer relationship management a…5.4
• CVE-2025-59429FreePBX is an open source GUI for managing Asterisk. In vers…5.4
• CVE-2025-5943MicroDicom DICOM Viewer suffers from an out-of-bounds writ…8.8