CVE-2013-7351

CVE-2013-7351 corresponds to multiple XSS flaws in Shaarli’s index.php. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML by crafting the URL for: (1) showRSS, (2) showATOM, (3) showDailyRSS; (4) a file name to importFile; or (5) vectors related to bookmarks. Conne...

CVE-2017-15215

CVE-2017-15215 is a reflected XSS vulnerability in Shaarli v0.9.1. An unauthenticated attacker can inject JavaScript via the searchtags parameter to index.php, potentially compromising admin sessions or altering global settings if the victim is an administrator, or executing JavaScript for unauth...

CVE-2018-5249

Shaarli contains a Cross-site scripting (XSS) vulnerability in versions prior to 0.8.5 and 0.9.x prior to 0.9.3. An attacker can inject arbitrary code via the login form’s username field (the ban_canLogin parameter in index.php). The issue is addressed in Shaarli v0.9.3 and v0.8.5 releases refere...

CVE-2023-49469

CVE-2023-49469 is a disclosed Reflected XSS in Shaarli v0.12.2. The vulnerability allows remote execution of arbitrary code via the search tag function. Affected product: Shaarli (v0.12.2); underlying issue: reflected XSS. Base CVSS score is 6.1 (MEDIUM) with network attack vector, no privileges ...

CVE-2026-24476

Shaarli (personal bookmarking service) is affected by CVE-2026-24476 prior to version 0.16.0. A malicious tag beginning with a double quote (") prematurely ends the start-page input tag and injects arbitrary HTML, enabling a possible XSS. The issue is fixed in version 0.16.0. Public references in...