CVE-2025-68927
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-68927
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-68927.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-68927
- Aliases
- Published
- 2025-12-27T00:04:49.621Z
- Modified
- 2026-01-04T05:42:30.324579Z
- Severity
-
- 7.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- Improper Neutralization of HTML Tags in a Web Page in libredesk
- Details
-
Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST /api/v1/contacts/{id}/notes, the backend automatically wraps user input in <p> tags. However, by intercepting the request and removing the <p> tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.
- Database specific
{ "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68927.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/abhinavxd/libredesk
Affected ranges
- Type
- GIT
- Repo
- https://github.com/abhinavxd/libredesk
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v0.*
v0.1.0-alpha
v0.1.1-alpha
v0.2.1-alpha
v0.3.0-alpha
v0.3.1-alpha
v0.3.2-alpha
v0.3.3-alpha
v0.4.0-alpha
v0.4.1-alpha
v0.4.2-alpha
v0.4.3-alpha
v0.5.0-alpha
v0.6.0-alpha
v0.7.0-alpha
v0.7.1-alpha
v0.7.2-alpha
v0.7.3-alpha
v0.7.4-alpha
v0.8.0-beta
v0.8.1-beta
v0.8.2-beta
v0.8.3-beta
v0.8.4-beta
v0.8.5-beta