EUVD-2026-16187
GHSA-vh39-72c6-788j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.
AnalysisAI
Timo 2.0.3 contains a stored cross-site scripting (XSS) vulnerability in the title field that allows unauthenticated remote attackers to inject malicious scripts via crafted links, resulting in session hijacking, credential theft, or malware distribution to other users viewing affected content. Publicly available exploit code exists (referenced via GitHub issue), and the vulnerability is rated CVSS 6.1 with cross-site scope impact, though no evidence of active exploitation in the wild has been confirmed at the time of analysis.
Technical ContextAI
This vulnerability exploits improper input validation and output encoding in Timo 2.0.3's title field handling, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause stems from failure to sanitize or escape user-supplied input before rendering it in HTML context, allowing attackers to embed arbitrary JavaScript payloads that execute in the browsers of users who view the crafted content. The affected product Timo (CPE information incomplete in source data) is a web-based application; the vulnerability specifically resides in the data persistence and display layer where user-submitted titles are stored and subsequently rendered without proper context-aware encoding.
RemediationAI
Upgrade Timo to a patched version released by the vendor after disclosure of CVE-2026-30162; consult the official Timo GitHub repository (https://github.com/auntvt/Timo) and NIST NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-30162) for exact patch version availability. As an immediate interim control, restrict title field input to a whitelist of safe characters (alphanumeric, spaces, hyphens, underscores), disable HTML rendering in title display contexts, and apply output encoding (HTML entity encoding) to all dynamically rendered title values. Implement a Content Security Policy (CSP) header with strict-dynamic and script-src 'self' to mitigate the impact of any injected scripts. Until patching is available, audit existing content for suspicious or encoded payloads in title fields and consider temporarily disabling the ability to edit titles if the application permits.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today