Search
Find a vulnerability
Search criteria
4 vulnerabilities found for libredesk by abhinavxd
CVE-2026-111168 (GCVE-0-2026-111168)
Vulnerability from nvd – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:40
VLAI
EPSS
VEX
Title
LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter
Summary
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:40 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/abhinavxd/libredesk/pull/641 | patchissue-tracking |
| https://github.com/abhinavxd/libredesk/commit/ab3… | patch |
| https://github.com/abhinavxd/libredesk/blob/086b0… | technical-description |
| https://github.com/abhinavxd/libredesk/blob/086b0… | technical-description |
| https://github.com/abhinavxd/libredesk/releases/t… | release-notes |
| https://github.com/abhinavxd/libredesk | product |
| https://www.vulncheck.com/advisories/libredesk-be… | third-party-advisory |
Impacted products
Date Public
2026-09-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:40:35.337819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:40:44.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/abhinavxd/libredesk",
"product": "libredesk",
"repo": "https://github.com/abhinavxd/libredesk",
"vendor": "abhinavxd",
"versions": [
{
"lessThan": "2.9.0-rc.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libredesk:libredesk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.9.0-rc.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dilshod Gofurov"
}
],
"datePublic": "2026-09-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed \u0027image/svg+xml; x\u0027 via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent\u0027s or administrator\u0027s session."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:54.024Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/abhinavxd/libredesk/pull/641"
},
{
"tags": [
"patch"
],
"url": "https://github.com/abhinavxd/libredesk/commit/ab3a5ca682fcc1caec0950fc607b66caea49bec3"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/cmd/media.go#L255-L272"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/internal/media/media.go#L422-L433"
},
{
"name": "libredesk v2.9.0-rc.8 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/abhinavxd/libredesk/releases/tag/v2.9.0-rc.8"
},
{
"tags": [
"product"
],
"url": "https://github.com/abhinavxd/libredesk"
},
{
"name": "VulnCheck Advisory: LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libredesk-before-2.9.0-rc.8-stored-xss-via-svg-upload-content-type-parameter"
}
],
"title": "LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111168",
"datePublished": "2026-10-15T18:57:54.024Z",
"dateReserved": "2026-10-15T17:04:06.214Z",
"dateUpdated": "2026-10-15T19:40:44.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68927 (GCVE-0-2025-68927)
Vulnerability from nvd – Published: 2025-12-27 00:04 – Updated: 2025-12-29 16:51
VLAI
EPSS
VEX
Title
Improper Neutralization of HTML Tags in a Web Page in libredesk
Summary
Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p> tags. However, by intercepting the request and removing the <p> tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-29 16:43 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/abhinavxd/libredesk/security/a… | x_refsource_CONFIRM |
| https://github.com/abhinavxd/libredesk/commit/270… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68927",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-29T16:43:28.357109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-29T16:51:24.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "libredesk",
"vendor": "abhinavxd",
"versions": [
{
"status": "affected",
"version": "\u003c 0.8.6-beta"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in \u003cp\u003e tags. However, by intercepting the request and removing the \u003cp\u003e tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-27T00:04:49.621Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4"
},
{
"name": "https://github.com/abhinavxd/libredesk/commit/270347849943ac6a43e9fd6ebdc99c71841900eb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/abhinavxd/libredesk/commit/270347849943ac6a43e9fd6ebdc99c71841900eb"
}
],
"source": {
"advisory": "GHSA-wh6m-h6f4-rjf4",
"discovery": "UNKNOWN"
},
"title": "Improper Neutralization of HTML Tags in a Web Page in libredesk"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-68927",
"datePublished": "2025-12-27T00:04:49.621Z",
"dateReserved": "2025-12-24T23:40:31.797Z",
"dateUpdated": "2025-12-29T16:51:24.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111168 (GCVE-0-2026-111168)
Vulnerability from cvelistv5 – Published: 2026-10-15 18:57 – Updated: 2026-10-15 19:40
VLAI
EPSS
VEX
Title
LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter
Summary
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent's or administrator's session.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 19:40 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/abhinavxd/libredesk/pull/641 | patchissue-tracking |
| https://github.com/abhinavxd/libredesk/commit/ab3… | patch |
| https://github.com/abhinavxd/libredesk/blob/086b0… | technical-description |
| https://github.com/abhinavxd/libredesk/blob/086b0… | technical-description |
| https://github.com/abhinavxd/libredesk/releases/t… | release-notes |
| https://github.com/abhinavxd/libredesk | product |
| https://www.vulncheck.com/advisories/libredesk-be… | third-party-advisory |
Impacted products
Date Public
2026-09-25 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T19:40:35.337819Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:40:44.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/abhinavxd/libredesk",
"product": "libredesk",
"repo": "https://github.com/abhinavxd/libredesk",
"vendor": "abhinavxd",
"versions": [
{
"lessThan": "2.9.0-rc.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:libredesk:libredesk:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.9.0-rc.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Dilshod Gofurov"
}
],
"datePublic": "2026-09-25T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed \u0027image/svg+xml; x\u0027 via /api/v1/media so GET /uploads/{uuid} serves it inline without sandbox, running script in any viewing agent\u0027s or administrator\u0027s session."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T18:57:54.024Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/abhinavxd/libredesk/pull/641"
},
{
"tags": [
"patch"
],
"url": "https://github.com/abhinavxd/libredesk/commit/ab3a5ca682fcc1caec0950fc607b66caea49bec3"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/cmd/media.go#L255-L272"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/abhinavxd/libredesk/blob/086b08200d667f2cc083635e925d6f5e7b0097e3/internal/media/media.go#L422-L433"
},
{
"name": "libredesk v2.9.0-rc.8 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/abhinavxd/libredesk/releases/tag/v2.9.0-rc.8"
},
{
"tags": [
"product"
],
"url": "https://github.com/abhinavxd/libredesk"
},
{
"name": "VulnCheck Advisory: LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/libredesk-before-2.9.0-rc.8-stored-xss-via-svg-upload-content-type-parameter"
}
],
"title": "LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111168",
"datePublished": "2026-10-15T18:57:54.024Z",
"dateReserved": "2026-10-15T17:04:06.214Z",
"dateUpdated": "2026-10-15T19:40:44.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-68927 (GCVE-0-2025-68927)
Vulnerability from cvelistv5 – Published: 2025-12-27 00:04 – Updated: 2025-12-29 16:51
VLAI
EPSS
VEX
Title
Improper Neutralization of HTML Tags in a Web Page in libredesk
Summary
Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p> tags. However, by intercepting the request and removing the <p> tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-29 16:43 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/abhinavxd/libredesk/security/a… | x_refsource_CONFIRM |
| https://github.com/abhinavxd/libredesk/commit/270… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-68927",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-29T16:43:28.357109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-29T16:51:24.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "libredesk",
"vendor": "abhinavxd",
"versions": [
{
"status": "affected",
"version": "\u003c 0.8.6-beta"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in \u003cp\u003e tags. However, by intercepting the request and removing the \u003cp\u003e tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-27T00:04:49.621Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/abhinavxd/libredesk/security/advisories/GHSA-wh6m-h6f4-rjf4"
},
{
"name": "https://github.com/abhinavxd/libredesk/commit/270347849943ac6a43e9fd6ebdc99c71841900eb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/abhinavxd/libredesk/commit/270347849943ac6a43e9fd6ebdc99c71841900eb"
}
],
"source": {
"advisory": "GHSA-wh6m-h6f4-rjf4",
"discovery": "UNKNOWN"
},
"title": "Improper Neutralization of HTML Tags in a Web Page in libredesk"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-68927",
"datePublished": "2025-12-27T00:04:49.621Z",
"dateReserved": "2025-12-24T23:40:31.797Z",
"dateUpdated": "2025-12-29T16:51:24.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}