CVE-2025-68927

Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p> tags. However, by intercepting the request and removing the <p> tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.

• CWE-79

• https://github.com/abhinavxd/libredesk/commit/270347849943ac6a43e9fd6ebdc99c71841900ebPatch
• https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4Exploit, Vendor Advisory
• https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4Exploit, Vendor Advisory

Published

Dec 27, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-68920C-Kermit (aka ckermit) through 10.0 Beta.12 (aka 416-beta12)…8.9
• CVE-2025-68921SteelSeries Nahimic 3 1.10.7 allows Directory traversal.7.8
• CVE-2025-68922OpenOps before 0.6.11 allows remote code execution in the Te…7.4
• CVE-2025-68924In Umbraco UmbracoForms through 8.13.16, an authenticated at…7.5
• CVE-2025-68925Jervis is a library for Job DSL plugin scripts and shared Je…5.3
• CVE-2025-68926RustFS is a distributed object storage system built in Rust.…9.8
• CVE-2025-68928Frappe CRM is an open-source customer relationship managemen…5.4
• CVE-2025-68929Frappe is a full-stack web application framework. Prior to v…9
• CVE-2025-6893An Execution with Unnecessary Privileges vulnerability has b…9.3
• CVE-2025-68930Versions of the Traccar open-source GPS tracking system up t…6.5
• CVE-2025-68931Jervis is a library for Job DSL plugin scripts and shared Je…7.5
• CVE-2025-68932FreshRSS is a free, self-hostable RSS aggregator. Prior to v…9.8