CVE-2025-1585

Tale Blog (otale tale) up to version 2.0.5 is affected. The vulnerability resides in the OptionsService function (src/main/resources/templates/themes/default/partial/header.html) where manipulating the logo_url argument enables cross-site scripting. The issue can be exploited remotely and the pub...

CVE-2025-69749

A Cross Site Scripting (XSS) vulnerability exists in tale v.2.0.5 , an open-source Java blog system. The flaw allows an attacker to execute arbitrary code via improper neutralization of input during web page generation. While the technical root cause is identified as XSS, the vulnerability is des...