PT-2025-45057

Name of the Vulnerable Software and Affected Versions LinkAce versions 2.3.1 and below Description LinkAce is a self-hosted archive to collect website links. The social media sharing functionality contains a Stored Cross-Site Scripting XSS issue that allows an authenticated user to inject arbitra...

LinkAce code issues and vulnerabilities

LinkAce is a self-hosted archive of links to your favorite websites by Kevin Woblick Individual Developer. A code issue vulnerability exists in LinkAce 2.3.0 and prior versions that stems from a failure to validate that the target of a user-supplied URL is an internal or private network resource,...

PT-2025-45056

Name of the Vulnerable Software and Affected Versions LinkAce versions 2.3.1 and below Description LinkAce is a self-hosted archive to collect website links. Authenticated RSS feed endpoints in the FeedController class do not implement proper authorization checks. This allows any authenticated us...

LinkAce Access Control Vulnerability

LinkAce is a self-hosted archive of links to your favorite websites by Kevin Woblick Individual Developer. An access control error vulnerability exists in LinkAce 2.3.1 and prior versions that stems from an authenticated RSS feed endpoint in the FeedController class that does not implement proper...

LinkAce Access Control Vulnerability

LinkAce is a self-hosted archive of links to your favorite websites by Kevin Woblick Individual Developer. An Access Control Error vulnerability exists in LinkAce 2.3.1 and prior versions, which stems from the HTML and CSV export functionality in the ExportController class not applying ownership ...

PT-2025-45055

Name of the Vulnerable Software and Affected Versions LinkAce versions prior to 2.4.0 Description LinkAce is a self-hosted archive for website links. Versions 2.3.1 and below permit any authenticated user to export the complete database of links, including private links intended only for their...

CVE-2025-62720: Exposure of Sensitive Information to an Unauthorized Actor

LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from all users in the system, including private links that should only be accessible to their owners. The HTML and CSV export functions in the...

CVE-2025-62722: Improper Neutralization of Input During Web Page Generation

LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, the social media sharing functionality contains a Stored Cross-Site Scripting XSS vulnerability that allows any authenticated user to inject arbitrary JavaScript by creating a link with malicious HTML in the...

CVE-2025-62721: Exposure of Sensitive Information to an Unauthorized Actor

LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users in the system,...

CVE-2025-62719: Server-Side Request Forgery (SSRF)

LinkAce is a self-hosted archive to collect website links. In versions 2.3.0 and below, the htmlKeywordsFromUrl function in the FetchController class accepts user-provided URLs and makes HTTP requests to them without validating that the destination is not an internal or private network resource...

LinkAce Cross-Site Script Vulnerabilities

LinkAce is a self-hosted archive of links to your favorite websites. A cross-site scripting vulnerability exists in LinkAce 2.3.1 and prior versions, which stems from insufficient validation of title field input by the social media sharing feature and can be exploited by an attacker to cause a...

PT-2025-45054

Name of the Vulnerable Software and Affected Versions LinkAce versions prior to 2.4.0 Description LinkAce is a self-hosted archive to collect website links. The htmlKeywordsFromUrl function within the FetchController class accepts user-provided URLs and makes HTTP requests without validating the...

EUVD-2024-53175

Malicious code in bioql PyPI...

EUVD-2024-53174

Malicious code in bioql PyPI...

EUVD-2025-27171

Malicious code in bioql PyPI...

CVE-2025-59424

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting XSS vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker...

CVE-2025-59424

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting XSS vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker...

CVE-2025-59424 LinkAce Vulnerable to Stored XSS on the Audit Page

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting XSS vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker...

CVE-2025-59424

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting XSS vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker...

CVE-2025-59424: Improper Neutralization of Input During Web Page Generation

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting XSS vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker...