CVE-2026-25144: Talishar

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Talishar is a fan-made Flesh and Blood project. A Stored XSS exists in the chat in-game system. The playerID parameter in SubmitChat.php and is saved without sanitization and executed whenever a user view the current page game. This vulnerability is fixed by 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4.

Affected products

• Talishar Talishar: before 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4 (fixed in 09dd00e5452e3cd998eb1406a88e5b0fa868e6b4)

Published 2026-02-02. Last modified 2026-06-17.