` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli's metadata fetcher copies a remote page's `` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.","url":"https://shellcodex.com/cves/CVE-2026-50190","datePublished":"2026-08-20T19:16:53+00:00","dateModified":"2026-08-20T19:16:53+00:00","inLanguage":"en","isAccessibleForFree":true,"mainEntityOfPage":{"@type":"WebPage","@id":"https://shellcodex.com/cves/CVE-2026-50190"},"about":{"@type":"Thing","name":"CVE-2026-50190","description":"Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark->getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `<title>` element without HTML escaping. A bookmark title containing `` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli's metadata fetcher copies a remote page's `` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.","sameAs":"https://nvd.nist.gov/vuln/detail/CVE-2026-50190"},"isBasedOn":"https://nvd.nist.gov/vuln/detail/CVE-2026-50190","citation":["https://nvd.nist.gov/vuln/detail/CVE-2026-50190","https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv"],"author":{"@type":"Organization","name":"ShellCodeX Intelligence","url":"https://shellcodex.com"},"publisher":{"@type":"Organization","name":"ShellCodeX","url":"https://shellcodex.com","logo":{"@type":"ImageObject","url":"https://shellcodex.com/settings/icons/1782429652_header.png"}}}</script>
<script type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://shellcodex.com"},{"@type":"ListItem","position":2,"name":"CVEs","item":"https://shellcodex.com/cves"},{"@type":"ListItem","position":3,"name":"CVE-2026-50190","item":"https://shellcodex.com/cves/CVE-2026-50190"}]}</script>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link
rel="preload"
as="style"
href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700&display=swap"
onload="this.onload=null;this.rel='stylesheet'">
<noscript>
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700&display=swap" rel="stylesheet">
</noscript>
<link rel="stylesheet" href="https://shellcodex.com/front/styles.css?v=1787101197">
<link rel="stylesheet" href="https://shellcodex.com/front/live-alert.css?v=1785108661">
<link rel="icon" type="image/svg+xml" href="https://shellcodex.com/settings/icons/1782429652_header.png">
<script async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-7045109870245083"
crossorigin="anonymous"></script>
<script async src="https://www.googletagmanager.com/gtag/js?id=G-2C20TKGZN0"></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag('js', new Date());
gtag('config', 'G-2C20TKGZN0');
</script>
<link rel="stylesheet" href="https://shellcodex.com/front/pages/cves.css?v=1786548347">
<!-- 🔍 LIVE SEARCH CSS -->
<style>
.search-results {
position: absolute;
top: calc(100% + 10px);
left: 0;
right: 0;
background: linear-gradient(180deg, #0b1220, #0a0f1a);
border: 1px solid rgba(255, 255, 255, .08);
border-radius: 14px;
overflow: hidden;
display: none;
z-index: 9999;
box-shadow: 0 30px 80px rgba(0, 0, 0, .65);
}
.search-item {
display: flex;
gap: 12px;
padding: 12px 14px;
align-items: center;
transition: background .2s ease;
}
.search-item:hover {
background: rgba(189, 95, 255, .12);
}
.search-thumb {
width: 44px;
height: 44px;
border-radius: 10px;
background: #111827;
flex-shrink: 0;
overflow: hidden;
display: flex;
align-items: center;
justify-content: center;
}
.search-thumb img {
width: 100%;
height: 100%;
object-fit: cover;
}
.search-content {
flex: 1;
}
.search-type {
font-size: 10px;
color: #a78bfa;
text-transform: uppercase;
letter-spacing: .04em;
}
.search-title {
font-size: 13px;
font-weight: 600;
color: #fff;
line-height: 1.3;
}
.search-footer {
padding: 10px 14px;
font-size: 12px;
text-align: center;
background: rgba(255, 255, 255, .03);
color: #9ca3af;
}
.site-ad-band {
display: flex;
justify-content: center;
width: 100%;
margin: 30px auto 0;
}
.site-ad-band--prominent {
margin-top: 12px;
margin-bottom: 2px;
}
.site-ad-slot {
width: min(100%, 728px);
height: 90px;
border: 1px dashed rgba(148, 163, 184, .24);
background:
linear-gradient(180deg, rgba(255, 255, 255, .025), rgba(255, 255, 255, .01)),
rgba(15, 23, 42, .34);
border-radius: 12px;
display: grid;
place-items: center;
overflow: hidden;
}
.site-ad-inner {
width: 100%;
height: 90px;
display: grid;
place-items: center;
color: rgba(203, 213, 225, .76);
font-size: 11px;
letter-spacing: .08em;
text-transform: uppercase;
}
.site-ad-inner .adsbygoogle {
width: 728px;
height: 90px;
max-width: 100%;
}
@media (min-width: 760px) {
.site-ad-band {
margin: 32px 0 4px;
}
}
@media (max-width: 520px) {
.site-ad-slot,
.site-ad-inner {
width: min(100%, 320px);
height: 100px;
}
.site-ad-inner .adsbygoogle {
width: 100% !important;
max-width: 320px !important;
height: 100px !important;
}
}
</style>
<script type="text/javascript" class="flasher-js">(function() { var rootScript = 'https://cdn.jsdelivr.net/npm/@flasher/flasher@1.3.2/dist/flasher.min.js'; var FLASHER_FLASH_BAG_PLACE_HOLDER = {}; var options = mergeOptions([], FLASHER_FLASH_BAG_PLACE_HOLDER); function mergeOptions(first, second) { return { context: merge(first.context || {}, second.context || {}), envelopes: merge(first.envelopes || [], second.envelopes || []), options: merge(first.options || {}, second.options || {}), scripts: merge(first.scripts || [], second.scripts || []), styles: merge(first.styles || [], second.styles || []), }; } function merge(first, second) { if (Array.isArray(first) && Array.isArray(second)) { return first.concat(second).filter(function(item, index, array) { return array.indexOf(item) === index; }); } return Object.assign({}, first, second); } function renderOptions(options) { if(!window.hasOwnProperty('flasher')) { console.error('Flasher is not loaded'); return; } requestAnimationFrame(function () { window.flasher.render(options); }); } function render(options) { if ('loading' !== document.readyState) { renderOptions(options); return; } document.addEventListener('DOMContentLoaded', function() { renderOptions(options); }); } if (1 === document.querySelectorAll('script.flasher-js').length) { document.addEventListener('flasher:render', function (event) { render(event.detail); }); } if (window.hasOwnProperty('flasher') || !rootScript || document.querySelector('script[src="' + rootScript + '"]')) { render(options); } else { var tag = document.createElement('script'); tag.setAttribute('src', rootScript); tag.setAttribute('type', 'text/javascript'); tag.onload = function () { render(options); }; document.head.appendChild(tag); }})();</script>
</head>
<body>
<div class="container stack">
<!-- Header -->
<header class="card pad header">
<a class="brand" href="https://shellcodex.com">
<img src="https://shellcodex.com/settings/icons/1782429652_header.png"
alt=""
width="42"
height="42"
decoding="async"
style="width:42px;height:42px;max-width:42px;max-height:42px;border-radius:12px;object-fit:contain;flex:0 0 42px;"
class="brand-logo">
<span class="brand-copy">
<div class="brand-title" style="font-weight:600;">ShellCodeX</div>
<div class="muted">Tools • Events • News • Insights</div>
</span>
</a>
<button class="mobile-nav-toggle" id="mobileNavToggle" type="button" aria-expanded="false" aria-controls="primaryNavigation" aria-label="Open navigation">
<span></span>
<span></span>
<span></span>
</button>
<nav class="tabs" id="primaryNavigation" aria-label="Primary navigation">
<button class="tab " onclick="location='/'">Feed</button>
<button class="tab " onclick="location='https://shellcodex.com/tools'">Tools</button>
<button class="tab " onclick="location='https://shellcodex.com/events'">Events</button>
<button class="tab " onclick="location='https://shellcodex.com/articles'">Articles</button>
<button class="tab is-active" onclick="location='https://shellcodex.com/cves'">CVEs</button>
<button class="tab " onclick="location='https://shellcodex.com/pulse'">Pulse</button>
<button class="tab " onclick="location='https://shellcodex.com/breaches'">Breaches</button>
<button class="tab " onclick="location='https://shellcodex.com/ransomware'">Ransomware</button>
<button class="tab tab-live " onclick="location='https://shellcodex.com/threat-radar'"><span class="tab-live-dot" aria-hidden="true"></span>Radar</button>
</nav>
<a class="seo-cta"
href="https://seo.shellcodex.com"
target="_blank"
rel="noopener"
title="Free SEO analysis for any website — ShellCodeX SEO Checker">
<span class="seo-cta-prompt" aria-hidden="true">>_</span>
<span class="seo-cta-text">SEO Checker</span>
<span class="seo-cta-arrow" aria-hidden="true">↗</span>
</a>
<!-- 🔍 SEARCH -->
<div class="header-right">
<div class="search">
<svg class="ico" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
<circle cx="11" cy="11" r="8"></circle>
<line x1="21" y1="21" x2="16.65" y2="16.65"></line>
</svg>
<input id="live-q" placeholder="Search articles & tools..." autocomplete="off">
<div id="searchResults" class="search-results"></div>
</div>
</div>
<script>
window.LIVE_SEARCH_URL = "https://shellcodex.com/live-search";
</script>
</header>
<script>
window.ASSET_BASE = "https://shellcodex.com/";
window.TOOL_IMAGE_BASE = "https://shellcodex.com/images/tools";
</script>
<section class="site-ad-band site-ad-band--prominent" aria-label="Advertisement">
<div class="site-ad-slot">
<div class="site-ad-inner">
<!-- ShellCodex -->
<ins class="adsbygoogle"
style="display:block;width:728px;height:90px"
data-ad-client="ca-pub-7045109870245083"
data-ad-slot="2010356328"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>
</div>
</section>
<main class="cve-detail">
<nav class="cve-breadcrumb" aria-label="Breadcrumb">
<a href="https://shellcodex.com">Home</a><span>/</span>
<a href="https://shellcodex.com/cves">CVE intelligence</a><span>/</span>
<span aria-current="page">CVE-2026-50190</span>
</nav>
<article>
<header class="cve-detail-hero cve-detail-hero--high">
<div class="cve-detail-hero__main">
<div class="cve-eyebrow">
<span class="cve-live-dot" aria-hidden="true"></span>
ShellCodeX vulnerability brief
</div>
<div class="cve-detail-hero__badges">
<span class="cve-severity cve-severity--high"><i></i>HIGH</span>
<span>Received</span>
</div>
<h1>CVE-2026-50190</h1>
<p>Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in `application/front/controller/visitor/BookmarkListController.php`. The `permalink` handler concatenates the raw `$bookmark->getTitle()` into the `pagetitle` template variable and the RainTPL template emits it into the document `<title>` element without HTML escaping. A bookmark title containing `</title><script>...</script>` closes the document title early and the injected script executes in the Shaarli origin for any visitor of `/shaare/{hash}`. Shaarli's metadata fetcher copies a remote page's `<title>` text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.</p>
<div class="cve-detail-hero__dates">
<span>Published <strong>20 Aug 2026, 19:16 UTC</strong></span>
<span>Last modified <strong>20 Aug 2026, 19:16 UTC</strong></span>
</div>
</div>
<aside class="cve-detail-score">
<div class="cve-score-ring cve-score-ring--large" style="--score: 86">
<span>8.6</span>
</div>
<strong>CVSS 4.0</strong>
<span>HIGH base score</span>
<code>CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</code> </aside>
</header>
<div class="cve-detail-layout">
<div class="cve-detail-main">
<section class="cve-panel">
<header class="cve-panel__head">
<div><span>01</span><h2>Attack profile</h2></div>
<p>The conditions required to exploit this vulnerability and its potential impact.</p>
</header>
<div class="cve-attack-grid">
<div class="">
<span>Attack vector</span>
<strong>Network</strong>
</div>
<div class="">
<span>Attack complexity</span>
<strong>Low</strong>
</div>
<div class="">
<span>Privileges required</span>
<strong>None</strong>
</div>
<div class="">
<span>User interaction</span>
<strong>Active</strong>
</div>
<div class="is-pending">
<span>Scope</span>
<strong>Not assessed</strong>
</div>
<div class="is-pending">
<span>Confidentiality</span>
<strong>Not assessed</strong>
</div>
<div class="is-pending">
<span>Integrity</span>
<strong>Not assessed</strong>
</div>
<div class="is-pending">
<span>Availability</span>
<strong>Not assessed</strong>
</div>
</div>
</section>
<section class="cve-panel">
<header class="cve-panel__head">
<div><span>02</span><h2>Affected products</h2></div>
<p>Product applicability statements supplied with the NVD record.</p>
</header>
<div class="cve-panel__empty">NVD has not published structured affected-product data for this record.</div>
</section>
<section class="cve-panel">
<header class="cve-panel__head">
<div><span>03</span><h2>Weakness classification</h2></div>
<p>CWE categories help security teams group the underlying software weakness.</p>
</header>
<div class="cve-weakness-list">
<a href="https://cwe.mitre.org/data/definitions/79.html" target="_blank" rel="noopener noreferrer">
<span>CWE</span><strong>CWE-79</strong><i aria-hidden="true">↗</i>
</a>
</div>
</section>
</div>
<aside class="cve-detail-side">
<section class="cve-side-card">
<span class="cve-section-index">Record intelligence</span>
<h2>At a glance</h2>
<dl>
<div><dt>CVE ID</dt><dd>CVE-2026-50190</dd></div>
<div><dt>Severity</dt><dd>HIGH</dd></div>
<div><dt>CVSS version</dt><dd>4.0</dd></div>
<div><dt>Record status</dt><dd>Received</dd></div>
<div><dt>Source</dt><dd>security-advisories@github.com</dd></div>
<div><dt>References</dt><dd>1</dd></div>
</dl>
</section>
<section class="cve-side-card cve-side-card--action">
<span class="cve-section-index">Recommended next step</span>
<h2>Validate your exposure</h2>
<p>Confirm affected products and versions in your environment, then review the vendor advisories below before applying changes.</p>
<a href="#source-references">Review source advisories <span>↓</span></a>
</section>
</aside>
</div>
<section class="cve-panel cve-references" id="source-references">
<header class="cve-panel__head">
<div><span>04</span><h2>Source references</h2></div>
<p>External advisories, patches and technical reports attached to this CVE record.</p>
</header>
<div class="cve-reference-list">
<a href="https://nvd.nist.gov/vuln/detail/CVE-2026-50190" target="_blank" rel="noopener noreferrer">
<span class="cve-reference-list__index">NVD</span>
<span><strong>National Vulnerability Database record</strong><small>nvd.nist.gov</small></span>
<i aria-hidden="true">↗</i>
</a>
<a href="https://github.com/shaarli/Shaarli/security/advisories/GHSA-xm98-h5jj-64xv" target="_blank" rel="noopener noreferrer">
<span class="cve-reference-list__index">01</span>
<span>
<strong>Technical reference</strong>
<small>security-advisories@github.com</small>
</span>
<i aria-hidden="true">↗</i>
</a>
</div>
</section>
</article>
<aside class="cve-attribution">
<strong>Data source transparency</strong>
<p>This product uses data from the NVD API but is not endorsed or certified by the NVD. Always confirm remediation guidance with the affected vendor.</p>
</aside>
</main>
<!-- Footer -->
<footer class="card pad footer">
<p>© <span id="year"></span> ShellCodeX — Cybersecurity tools, CVE intelligence, technology pulse and source-backed research.</p>
<div class="foot-links">
<a class="muted" href="https://shellcodex.com/about">About</a>
<a class="muted" href="https://shellcodex.com/pulse">Technology Pulse</a>
<a class="muted" href="https://shellcodex.com/breaches">Breach Tracker</a>
<a class="muted" href="https://shellcodex.com/ransomware">Ransomware Radar</a>
<a class="muted" href="https://shellcodex.com/threat-radar">Threat Radar</a>
<a class="muted" href="https://shellcodex.com/cves">CVEs</a>
<a class="muted" href="https://seo.shellcodex.com" target="_blank" rel="noopener">SEO Checker</a>
<a class="muted" href="#">Privacy</a>
<a class="muted" href="#">Contact</a>
</div>
<div class="social-block">
<span class="social-label">Follow ShellCodeX</span>
<nav class="social-links" aria-label="ShellCodeX on social media">
<a class="social-btn social-btn--x" href="https://x.com/ShellCodeXHQ"
target="_blank" rel="me noopener" aria-label="ShellCodeX on X (Twitter)">
<svg viewBox="0 0 24 24" width="17" height="17" fill="currentColor" aria-hidden="true"><path d="M18.244 2.25h3.308l-7.227 8.26 8.502 11.24h-6.66l-5.214-6.817-5.968 6.817H1.475l7.73-8.835L1.05 2.25h6.83l4.713 6.231zm-1.161 17.52h1.833L7.084 4.126H5.117z"/></svg>
</a>
<a class="social-btn social-btn--linkedin" href="https://www.linkedin.com/company/shellcodex"
target="_blank" rel="me noopener" aria-label="ShellCodeX on LinkedIn">
<svg viewBox="0 0 24 24" width="18" height="18" fill="currentColor" aria-hidden="true"><path d="M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85 3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.062 2.062 0 01-2.063-2.065 2.064 2.064 0 112.063 2.065zm1.782 13.019H3.555V9h3.564v11.452zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0h.003z"/></svg>
</a>
<a class="social-btn social-btn--instagram" href="https://www.instagram.com/shellcodex/"
target="_blank" rel="me noopener" aria-label="ShellCodeX on Instagram">
<svg viewBox="0 0 24 24" width="18" height="18" fill="currentColor" aria-hidden="true"><path d="M12 2.163c3.204 0 3.584.012 4.85.07 3.252.148 4.771 1.691 4.919 4.919.058 1.265.069 1.645.069 4.849 0 3.205-.012 3.584-.069 4.849-.149 3.225-1.664 4.771-4.919 4.919-1.266.058-1.644.07-4.85.07-3.204 0-3.584-.012-4.849-.07-3.26-.149-4.771-1.699-4.919-4.92-.058-1.265-.07-1.644-.07-4.849 0-3.204.013-3.583.07-4.849.149-3.227 1.664-4.771 4.919-4.919 1.266-.057 1.645-.069 4.849-.069zM12 0C8.741 0 8.333.014 7.053.072 2.695.272.273 2.69.073 7.052.014 8.333 0 8.741 0 12c0 3.259.014 3.668.072 4.948.2 4.358 2.618 6.78 6.98 6.98C8.333 23.986 8.741 24 12 24c3.259 0 3.668-.014 4.948-.072 4.354-.2 6.782-2.618 6.979-6.98.059-1.28.073-1.689.073-4.948 0-3.259-.014-3.667-.072-4.947-.196-4.354-2.617-6.78-6.979-6.98C15.668.014 15.259 0 12 0zm0 5.838a6.162 6.162 0 100 12.324 6.162 6.162 0 000-12.324zM12 16a4 4 0 110-8 4 4 0 010 8zm6.406-11.845a1.44 1.44 0 100 2.881 1.44 1.44 0 000-2.881z"/></svg>
</a>
<a class="social-btn social-btn--facebook" href="https://www.facebook.com/ShellCodexHQ/"
target="_blank" rel="me noopener" aria-label="ShellCodeX on Facebook">
<svg viewBox="0 0 24 24" width="18" height="18" fill="currentColor" aria-hidden="true"><path d="M24 12.073c0-6.627-5.373-12-12-12s-12 5.373-12 12c0 5.99 4.388 10.954 10.125 11.854v-8.385H7.078v-3.47h3.047V9.43c0-3.007 1.792-4.669 4.533-4.669 1.312 0 2.686.235 2.686.235v2.953H15.83c-1.491 0-1.956.925-1.956 1.874v2.25h3.328l-.532 3.47h-2.796v8.385C19.612 23.027 24 18.062 24 12.073z"/></svg>
</a>
</nav>
</div>
</footer>
</div>
<script src="https://shellcodex.com/front/app.js" defer></script>
<!-- 🔍 LIVE SEARCH JS -->
<script>
document.addEventListener("DOMContentLoaded", () => {
const input = document.getElementById("live-q");
const results = document.getElementById("searchResults");
const yearEl = document.getElementById("year");
let timer = null;
if (yearEl) yearEl.textContent = new Date().getFullYear();
const navToggle = document.getElementById("mobileNavToggle");
const siteHeader = navToggle?.closest(".header");
navToggle?.addEventListener("click", () => {
const isOpen = siteHeader?.classList.toggle("nav-open");
navToggle.setAttribute("aria-expanded", isOpen ? "true" : "false");
navToggle.setAttribute("aria-label", isOpen ? "Close navigation" : "Open navigation");
});
if (!input || !results) return;
input.addEventListener("input", () => {
clearTimeout(timer);
const q = input.value.trim();
if (q.length < 2) {
results.style.display = "none";
results.innerHTML = "";
return;
}
timer = setTimeout(async () => {
try {
const res = await fetch(`${window.LIVE_SEARCH_URL}?q=${encodeURIComponent(q)}`);
if (!res.ok) throw new Error("HTTP error");
const data = await res.json();
let html = "";
data.articles?.forEach(a => {
const img = a.image_url || `${window.ASSET_BASE}images/placeholder-article.webp`;
html += `
<a href="/article/${a.slug}" class="search-item">
<div class="search-thumb">
<img src="${img}" alt="">
</div>
<div class="search-content">
<div class="search-type">Article</div>
<div class="search-title">${a.title}</div>
</div>
</a>`;
});
data.tools?.forEach(t => {
const img = t.image_url || `${window.ASSET_BASE}images/placeholder-tool.webp`;
html += `
<a href="/tool/${t.slug}" class="search-item">
<div class="search-thumb">
<img src="${img}" alt="">
</div>
<div class="search-content">
<div class="search-type">Tool</div>
<div class="search-title">${t.title}</div>
</div>
</a>`;
});
if (!html) {
html = `<div class="search-footer">No results found</div>`;
}
results.innerHTML = html;
results.style.display = "block";
} catch (e) {
results.innerHTML = `<a>Error loading results</a>`;
results.style.display = "block";
}
}, 250);
});
document.addEventListener("click", e => {
if (!e.target.closest(".search")) {
results.style.display = "none";
}
});
});
</script>
<script src="https://shellcodex.com/front/live-alert.js?v=1785108661" defer></script>
<script
data-name="BMC-Widget"
data-cfasync="false"
src="https://cdnjs.buymeacoffee.com/1.0.0/widget.prod.min.js"
data-id="shellcodex"
data-description="Support ShellCodeX"
data-message="Enjoy the content? You can support ShellCodeX here ☕"
data-color="#BD5FFF"
data-position="Right"
data-x_margin="18"
data-y_margin="18">
</script>
</body>
</html>