Taguette
Monthly
Open redirect in Taguette 1.5.1 and earlier lets a remote attacker send an authenticated or about-to-authenticate user to an arbitrary external website by appending a crafted 'next' parameter to the legitimate instance's /login or /cookies URL, which the application passes unvalidated into its HTTP redirect. Per the supplied CVSS vector the attacker needs no privileges (PR:N) but the victim must be lured into clicking the link and completing login or accepting the cookie prompt (UI:R), and the impact is limited to browser-level redirection for phishing, credential harvesting, or malware delivery rather than server compromise. Exploit code is publicly available in the GHSA-5923-r76v-mprm advisory, no CISA KEV entry indicates active exploitation, and EPSS is low at 0.26% (17th percentile); this is a genuine but moderate-priority issue, not a critical one.
Stored cross-site scripting in Taguette versions prior to 1.5.0 lets any existing project member plant JavaScript inside tag names, tag descriptions, document names, or document descriptions, which then executes in the browser of another project member who loads the affected project (CVSS 5.4, CWE-79). Exploitation requires authenticated project membership (PR:L) and victim interaction (UI:R), so the flaw is only meaningful in shared, multi-user Taguette deployments rather than single-user installs; the stored payload can alter page content and behavior within the victim's session (scope changed, low confidentiality and integrity impact). No public exploit code has been identified and the issue is not confirmed as actively exploited; EPSS is 0.18% (7th percentile), indicating low predicted exploitation likelihood. Vendor-released patch: 1.5.0.
Password reset link poisoning in Taguette versions prior to 1.5.0 allows unauthenticated remote attackers to redirect the password-reset email to attacker-controlled infrastructure, enabling the attacker to set the victim's email address if the victim clicks the malicious link. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) and stems from external control of a configuration setting (CWE-15). No public exploit has been identified at time of analysis, and the vendor has released a patch in version 1.5.0.
Open redirect in Taguette 1.5.1 and earlier lets a remote attacker send an authenticated or about-to-authenticate user to an arbitrary external website by appending a crafted 'next' parameter to the legitimate instance's /login or /cookies URL, which the application passes unvalidated into its HTTP redirect. Per the supplied CVSS vector the attacker needs no privileges (PR:N) but the victim must be lured into clicking the link and completing login or accepting the cookie prompt (UI:R), and the impact is limited to browser-level redirection for phishing, credential harvesting, or malware delivery rather than server compromise. Exploit code is publicly available in the GHSA-5923-r76v-mprm advisory, no CISA KEV entry indicates active exploitation, and EPSS is low at 0.26% (17th percentile); this is a genuine but moderate-priority issue, not a critical one.
Stored cross-site scripting in Taguette versions prior to 1.5.0 lets any existing project member plant JavaScript inside tag names, tag descriptions, document names, or document descriptions, which then executes in the browser of another project member who loads the affected project (CVSS 5.4, CWE-79). Exploitation requires authenticated project membership (PR:L) and victim interaction (UI:R), so the flaw is only meaningful in shared, multi-user Taguette deployments rather than single-user installs; the stored payload can alter page content and behavior within the victim's session (scope changed, low confidentiality and integrity impact). No public exploit code has been identified and the issue is not confirmed as actively exploited; EPSS is 0.18% (7th percentile), indicating low predicted exploitation likelihood. Vendor-released patch: 1.5.0.
Password reset link poisoning in Taguette versions prior to 1.5.0 allows unauthenticated remote attackers to redirect the password-reset email to attacker-controlled infrastructure, enabling the attacker to set the victim's email address if the victim clicks the malicious link. The flaw is rated CVSS 3.1 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) and stems from external control of a configuration setting (CWE-15). No public exploit has been identified at time of analysis, and the vendor has released a patch in version 1.5.0.