CVE-2025-26527

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-1230

Affected software

No affected versions have been published.

Timeline

Published
Feb 24, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-265286.1The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.CVE-2025-265296.1Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.CVE-2025-26534.3A vulnerability was found in FoxCMS 1.25 and classified as problematic. Affected by this issue is some unknown functionality. The manipulatiCVE-2025-265306.1The question bank filter required additional sanitizing to prevent a reflected XSS risk.CVE-2025-265315.3Insufficient capability checks made it possible to disable badges a user does not have permission to access.CVE-2025-265324.3Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.CVE-2025-265339.8An SQL injection risk was identified in the module list filter within course search.CVE-2025-265348.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in helloprint Helloprint helloprint allows PathCVE-2025-265359.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CodeSolz Bitcoin / AltCoin Payment GatCVE-2025-265367.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yendif Player Another Events Calendar CVE-2025-265376.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rolomak GDPR Tools gdpr-tools allows SCVE-2025-265386.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Prezi Embedder prezi-embe
CVE-2025-26527: Medium severity, CVSS 5.3 | Vulnix