CVE-2025-58430: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the requests to be...