CVE-2025-61457

code16 Sharp, a Laravel-based framework for building content-management and administrative interfaces, prior to 9.22.5 contains a stored cross-site scripting vulnerability in SharpEditorFormField. Attacker-controlled content bearing the data-html-content attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. Version 9.22.5 is identified as patched.

code16 Sharp, a Laravel-based framework for building content-management and administrative interfaces, prior to 9.22.5 contains a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup inside srcdoc is HTML-encoded during sanitization, browsers decode attribute entities before interpreting the iframe document, allowing an authenticated user with permission to edit an Editor field to store executable JavaScript that runs when another user views the content. Version 9.22.5 removes srcdoc from permitted iframe attributes.