6.5
Medium
CVE-2025-60105 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in…
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ditty 3.1 | earliest → 3.1.58 | No fix stated |
Other CVEs of Ditty
The 10 CVEs of Ditty →
CVE-2026-94461
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions
6.5
Medium
CVE-2026-81274
Subscriber Broken Access Control in Ditty <= 3.1.67 versions
5.3
Medium
CVE-2026-27355
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions
5.3
Medium
CVE-2023-47764
Missing Authorization vulnerability in metaphorcreations Ditty ditty-news-ticker allows Exploiting Incorrectly…
6.5
Medium