PT-2025-42928 · Unknown · Code16/Sharp

Published 2025-10-21 · Updated 2025-10-23 · CVE-2025-61457

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions code16 Sharp version 9.6.6

Description The software contains a Cross Site Scripting (XSS) issue located in src/Form/Fields/SharpFormUploadField.php.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-61457

GHSA-9778-V769-QVJF

Affected Products

Code16/Sharp

References · 12

• 🔥 https://github.com/chimmeee/vulnerability-research/blob/main/CVE-2025-61457 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61457 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61457 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9778-v769-qvjf · Vendor Advisory
• https://github.com/code16/sharp/blob/6d106b05aa07c6b46f5de28f909b732e1bbcdc47/src/Form/Fields/SharpFormUploadField.php#L97 · Note
• https://github.com/code16/sharp/issues/611 · Note
• https://github.com/code16/sharp/releases/tag/v9.7.0 · Note
• https://github.com/code16/sharp/commit/bf7fedf2086d86aac16194733a6385564e5cf124 · Note
• https://github.com/code16/sharp · Note
• https://twitter.com/CVEnew/status/1980717794208706578 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1odakwu/resumen_diario_de_vulnerabilidades_22102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1oe66u4/resumen_diario_de_vulnerabilidades_23102025 · Reddit Post