CVE-2025-49489

creationtimestamp| type| source ---|---|--- 2025-07-01 10:04:31+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lsvh4hni4go2 2025-07-01 10:08:36+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/20012 2025-07-01 12:26:44+00:00| seen|...

CVE-2023-25154 Cross site scripting (XSS) of ActivityPub URI in misskey

Misskey is an open source, decentralized social media platform. In versions prior to 13.5.0 the link to the instance to the sender that appears when viewing a user or note received through ActivityPub is not properly validated, so by inserting a URL with a javascript scheme an attacker may execut...