CVE-2026-24476

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Shaarli is a personal bookmarking service. Prior to version 0.16.0, crafting a malicious tag which starting with `"` prematurely ends the `<input>` tag on the start page and allows an attacker to add arbitrary html leading to a possible XSS attack. Version 0.16.0 fixes the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 26, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-244777.5AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM pCVE-2026-244787.2AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to versionCVE-2026-244799.8HUSTOF is an open source online judge based on PHP/C++/MySQL/Linux for ACM/ICPC and NOIP training. Prior to version 26.01.24, the problem_imCVE-2026-24488.8The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.5 via tCVE-2026-244808.7QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "CVE-2026-244817.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, a hCVE-2026-244845.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, MagCVE-2026-244857.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, wheCVE-2026-244867.5Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-dCVE-2026-244876.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an authorizCVE-2026-244886.5OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0CVE-2026-244895.3Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to vers