CVE-2025-55291CWE-79CWE-80CWE-87

Shaarli allows reflected XSS via searchtags parameter

High · published August 18, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allows the </title> tag to be prematurely closed, leading to a reflected Cross-Site Scripting (XSS) vulnerability. This vulnerability is fixed in 0.15.0.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS); CWE-87 · Improper Neutralization of Alternate XSS Syntax
Published
2025-08-18T17:06Z
EPSS history
Timeline
  • 18 AUG 17:06Z
    Shaarli allows reflected XSS via searchtags parameter
    cvelistv5