Buku
Monthly
Stored cross-site scripting in buku's optional bukuserver web component (versions 5.0 through 5.1.1) lets an unauthenticated remote attacker plant a bookmark URL that executes JavaScript in the browser of any user who later opens the bookmark list page. Because the injected script runs same-origin with the bukuserver UI, it can issue API requests carrying the viewer's credentials, but the realized damage is bounded to those same-origin actions and requires a separate victim to load the affected page (passive user interaction). No CISA KEV entry and no public exploit identified at time of analysis; this is a genuine but moderate-priority web vulnerability rather than a high-urgency emergency.
Stored cross-site scripting in buku's optional bukuserver web component (versions 5.0 through 5.1.1) lets an unauthenticated remote attacker plant a bookmark URL that executes JavaScript in the browser of any user who later opens the bookmark list page. Because the injected script runs same-origin with the bukuserver UI, it can issue API requests carrying the viewer's credentials, but the realized damage is bounded to those same-origin actions and requires a separate victim to load the affected page (passive user interaction). No CISA KEV entry and no public exploit identified at time of analysis; this is a genuine but moderate-priority web vulnerability rather than a high-urgency emergency.