{"id":74954,"date":"2025-12-27T04:45:42","date_gmt":"2025-12-27T01:15:42","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2025-68927-improper-neutralization-of-html-tags-in-a-web-page-in-libredesk\/"},"modified":"2025-12-27T04:45:42","modified_gmt":"2025-12-27T01:15:42","slug":"cve-2025-68927-improper-neutralization-of-html-tags-in-a-web-page-in-libredesk","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2025-68927-improper-neutralization-of-html-tags-in-a-web-page-in-libredesk\/","title":{"rendered":"CVE-2025-68927 &#8211; Improper Neutralization of  HTML Tags in a Web Page in libredesk"},"content":{"rendered":"<p>CVE ID : CVE-2025-68927<\/p>\n<p>Published :  Dec. 27, 2025, 1:15 a.m. | 1\u00a0hour, 7\u00a0minutes ago<\/p>\n<p>Description : Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST \/api\/v1\/contacts\/{id}\/notes, the backend automatically wraps user input in  tags. However, by intercepting the request and removing the  tag, an attacker can inject arbitrary HTML elements such as forms and images, which are then stored and rendered without proper sanitization. This can lead to phishing, CSRF-style forced actions, and UI redress attacks. This issue has been patched in version 0.8.6-beta.<\/p>\n<p>Severity: 7.3 | HIGH<\/p>\n<p>Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID : CVE-2025-68927 Published : Dec. 27, 2025, 1:15 a.m. | 1\u00a0hour, 7\u00a0minutes ago Description : Libredesk is a self-hosted customer support desk. Prior to version 0.8.6-beta, LibreDesk is vulnerable to stored HTML injection in the contact notes feature. When adding notes via POST \/api\/v1\/contacts\/{id}\/notes, the backend automatically wraps user input in tags. However, &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-74954","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/74954","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=74954"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/74954\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=74954"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=74954"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=74954"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}