CVE-2025-53838 (CNNVD-202509-1058)
中文标题:
LinkAce 跨站脚本漏洞
英文标题:
LinkAce has a Stored One Click XSS vulnerability
漏洞描述
中文描述:
LinkAce是Kevin Woblick个人开发者的一个自托管档案库，用于收集您最喜爱的网站的链接。 LinkAce 2.1.9之前版本存在跨站脚本漏洞，该漏洞源于存储型跨站脚本攻击，可能导致任意脚本执行。
英文描述:
LinkAce is a self-hosted archive to collect website links. A stored cross-site scripting (XSS) vulnerability was discovered in versions prior to 2.1.9 that allows an attacker to inject arbitrary JavaScript, which is then executed in the context of a user's browser when the malicious link is clicked. This is a one-click XSS, meaning the victim only needs to click a crafted link — no further interaction is required. The application contains a stored XSS vulnerability due to insufficient filtering and escaping of user-supplied data inserted into link attributes. Malicious JavaScript code can be saved in the database along with the link and executed in the user’s browser when clicking the link, leading to arbitrary script execution within the context of the site. Version 2.1.9 fixes the issue.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Kovah | LinkAce | < 2.1.9 | - | - |
cpe:2.3:a:kovah:linkace:<_2.1.9:*:*:*:*:*:*:*
|
| linkace | linkace | * | - | - |
cpe:2.3:a:linkace:linkace:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-53838 |
2025-11-11 15:23:28 | 2025-11-11 07:40:41 |
| NVD | nvd_CVE-2025-53838 |
2025-11-11 15:01:02 | 2025-11-11 07:48:29 |
| CNNVD | cnnvd_CNNVD-202509-1058 |
2025-11-11 15:12:56 | 2025-11-11 08:00:09 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 跨站脚本
- cnnvd_id: 未提取 -> CNNVD-202509-1058
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']