CVE-2026-50190

creationtimestamp| type| source ---|---|--- 2026-08-20 22:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtkbpy4m5r2u...

CVE-2026-50190

Shaarli versions prior to 0.16.3 are vulnerable to stored XSS in the permalink handler of BookmarkListController.php, where raw bookmark titles are emitted unescaped into the document . An attacker who controls a remote page's title can have it fetched verbatim when an admin bookmarks the URL, pl...