CVE-2025-71462
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login.