PT-2025-45385 · Unknown · Thinkdashboard

Published 2025-11-06 · Updated 2025-11-21 · CVE-2025-64177

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ThinkDashboard versions prior to 0.6.8

Description ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. A stored Cross-Site Scripting (XSS) issue exists in the dashboard for versions 0.6.7 and below due to a lack of scheme filtering. This allows exploitation when a user clicks on a malicious bookmark. The issue is triggered by the absence of proper input validation when handling bookmark data.

Recommendations Update to version 0.6.8 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-64177

GHSA-57F2-RHXM-FJV3

Affected Products

Thinkdashboard

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64177.json · Exploit
• https://github.com/MatiasDesuu/ThinkDashboard/security/advisories/GHSA-57f2-rhxm-fjv3 · Vendor Advisory
• https://github.com/MatiasDesuu/ThinkDashboard/commit/16976263b22a4b0526b2c7c30294cc099258edae · Patch
• https://osv.dev/vulnerability/CVE-2025-64177 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64177 · Security Note
• https://twitter.com/VulmonFeeds/status/1986577796068442323 · Twitter Post
• https://twitter.com/CVEnew/status/1986577136900317264 · Twitter Post
• https://t.me/CVEtracker/36720 · Telegram Post
• https://t.me/cveNotify/143610 · Telegram Post