Executive brief
Indico vulnerable to Cross-Site Scripting via LaTeX math code
Affected products
- PyPI indico
Junglewise Threat Intelligence
CVE-2025-59035: PYSEC-2026-1461 - Indico vulnerable to Cross-Site Scripting via LaTeX math code
CVE-2025-59035 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: indico (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1460 - Indico may disclose unauthorized user details access via legacy API
- PYSEC-2026-1462 - Indico vulnerability allows attackers to bulk dump user details
- PYSEC-2026-1459 - Indico Insecure Access
- PYSEC-2026-2184 - Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12
- PYSEC-2026-2183 - Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11