{"id":"EUVD-2025-205421","enisaUuid":"677ba1ef-0b45-3d9f-82a6-37941952df35","description":"In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.","datePublished":"Dec 26, 2025, 4:14:03 AM","dateUpdated":"Dec 26, 2025, 6:59:45 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://blog.gitea.com/release-of-1.20.1/\nhttps://github.com/go-gitea/gitea/releases/tag/v1.20.1\nhttps://github.com/go-gitea/gitea/pull/25960\n","aliases":"CVE-2025-68946\nGHSA-hq57-c72x-4774\n","assigner":"mitre","epss":0.25,"enisaIdProduct":[{"id":"f5298756-9c2e-382a-b124-8dcc2ec14e35","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"1.20.0 \u003c1.20.1"}],"enisaIdVendor":[{"id":"9c551071-52bb-3af0-9af5-965f33e34e1c","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"13556565-9b30-3586-bdd9-bb824432d264","vulnerability":{"id":"GHSA-hq57-c72x-4774","description":"Gitea vulnerable to Cross-site Scripting","datePublished":"Dec 26, 2025, 6:30:27 AM","dateUpdated":"Dec 26, 2025, 7:46:52 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-68946\nhttps://github.com/go-gitea/gitea/pull/25960\nhttps://blog.gitea.com/release-of-1.20.1\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.20.1\n","enisa_id":"EUVD-2025-205421\n","aliases":"CVE-2025-68946\nGHSA-hq57-c72x-4774\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:54:33 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"2f918408-f0ac-331c-afd7-56b8635ec842","vulnerability":{"id":"CVE-2025-68946","description":"In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.","datePublished":"Dec 26, 2025, 4:14:03 AM","dateUpdated":"Dec 26, 2025, 6:59:45 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://blog.gitea.com/release-of-1.20.1/\nhttps://github.com/go-gitea/gitea/releases/tag/v1.20.1\nhttps://github.com/go-gitea/gitea/pull/25960\n","enisa_id":"EUVD-2025-205421\n","assigner":"mitre","epss":0.25,"dataProcessed":"Nov 8, 2026, 7:13:21 AM","vulnerabilityProduct":[{"id":"a0ebc653-5ad1-3210-bbaa-7754604f4d6f","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"1.20.0 \u003c1.20.1"}],"vulnerabilityVendor":[{"id":"f5223eff-4fde-339a-9b4e-ae8b930e6038","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}