CVE-2025-55161 Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf

Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security...

Cross-site Scripting (XSS)

github.com/usememos/memos is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unrestricted external image embedding because markdown images with arbitrary URLs are automatically fetched when viewing a memo, exposing the user's IP address, browser User-Agent, and other...

Stirling-PDF 代码问题漏洞

Stirling-PDF is a powerful, locally hosted, web-based PDF manipulation tool using Docker, open-sourced by Stirling Tools. A code issue vulnerability exists in Stirling-PDF versions prior to 1.1.0 that stems from a cleaner in the Markdown to PDF feature that can be bypassed, potentially leading to...

PT-2025-32596

Name of the Vulnerable Software and Affected Versions: Stirling-PDF versions prior to 1.1.0 Description: Stirling-PDF is a locally hosted web application used for PDF file operations. Prior to version 1.1.0, the application is susceptible to Server-Side Request Forgery SSRF when utilizing the...

Linux Distros Unpatched Vulnerability : CVE-2025-3512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is a Heap-based Buffer Overflow vulnerability in QTextMarkdownImporter. This requires an incorrectly formatted markdown file to be passed to...

Linux Distros Unpatched Vulnerability : CVE-2024-32875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in...

VulnCheck KEV: CVE-2025-53833

LaRecipe is an application that allows users to create documentation with Markdown inside a Laravel app. Versions prior to 2.8.1 are vulnerable to Server-Side Template Injection SSTI, which could potentially lead to Remote Code Execution RCE in vulnerable configurations. Attackers could execute...

SUSE CVE-2025-32019

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1 and 2.13.0-rc1, contain a vulnerability where the markdown field in the info tab page can be exploited to inject XSS code. This is fixed ...

SUSE CVE-2025-52902

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting XSS. Any JavaScript code that is part of a...

Regular Expression Denial of Service (ReDoS)

Overview markdown2 is a fast and complete Python implementation of Markdown. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the sortahtmltokenizere regex used in the HTML tokenizer due to improperly constraining quoted attribute values ".?",...

aequitas (>=0.26.0 <=0.42.0), ai-parrot (>=0.5.0 <=0.10.0) +75 more potentially affected by unknown CVE via markdown2 (>=2.3.0 <=2.5.3)

markdown2 PYPI version =2.3.0, =0.26.0, =0.5.0, =0.0.1, =0.0.1, =2.0.4, =0.39.0, =0.1.0, =0.0.465, =0.0.45, =0.5.29, =0.1.1, =0.1.0, =0.1.2 - criscostack =1.0.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-MARKDOWN2-11356593...

Cross-site Scripting (XSS)

Overview markdown2 is a fast and complete Python implementation of Markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS in safemode due to improper handling of incomplete HTML tags. The encodeincompletetags function fails to properly check for auto links, allowin...

org.apache.jspwiki.wikipages:jspwiki-wikipages-builder (=2.12.2), org.apache.jspwiki.wikipages:jspwiki-wikipages-de (=2.12.2) +10 more potentially affected by CVE-2025-24853 via org.apache.jspwiki:jspwiki-markdown (>=2.11.0 <=2.12.2)

org.apache.jspwiki:jspwiki-markdown MAVEN version =2.11.0, =2.11.0, =2.12.2 Source cves: CVE-2025-24853 Source advisory: OSV:GHSA-RRFF-CHJ9-W4C7...

GHSA-RRFF-CHJ9-W4C7 Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this...

Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this...

CVE-2025-24853 Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this...

CVE-2025-24853 Apache JSPWiki: Cross-Site Scripting (XSS) in JSPWiki Header Link processing

A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Further research by the JSPWiki team showed that the markdown parser allowed this...

Cross-site Scripting (XSS)

github.com/goharbor/harbor is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to unsanitized content in the markdown field on the info tab page, which allows injection of malicious scripts...

CVE-2025-50738

The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be...

GHSA-HFCF-79GH-F3JC Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs

The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be...