buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView._list_entry(). Attackers can submit a URL containing a double quote and event handler through the unauthenticated /api/bookmarks endpoint to issue same-origin API requests with viewers' credentials.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/jarun/buku/issues/911 Üçüncü taraf
• vulncheck.com/….1-stored-xss-via-bukuserver-bookmark-list-url Üçüncü taraf
• github.com/jarun/buku/blob/v5.1.1/bukuserver/views.py Diğer
• github.com/jarun/buku Diğer

Kayıt geçmişi

1. 3 Kas 2026 20:13Yayımlandı

İlgili açıklar

• 5,3 CVE-2026-123201buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API
• 6,1 CVE-2026-88986Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses
• 6,1 CVE-2026-110802Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
• 8,1 CVE-2026-103935OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
• 6,3 CVE-2026-76580Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenTe…
• 8,6 CVE-2026-107903Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0