CVE-2025-64177 — ThinkDashboard: Stored XSS in Dashboard via Malicious Bookmark
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting (XSS) vulnerability …
Published: 2025-11-06 · CVSS: 5.4 · CVSS 3.1
ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting (XSS) vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme filtering. This is fixed in version 0.6.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7