Shaarli is a personal bookmarking service. Versions prior to 0.16.3 are vulnerable to stored XSS in "application/front/controller/visitor/BookmarkListController.php". The "permalink" handler concatenates the raw "$bookmark->getTitle()" into the "pagetitle" template variable and the RainTPL template emits it into the document "<title>" element without HTML escaping. A bookmark title containing "</title><script>...</script>" closes the document title early and the injected script executes in the Shaarli origin for any visitor of "/shaare/{hash}". Shaarli's metadata fetcher copies a remote page's "<title>" text verbatim into the local bookmark title, so an attacker who hosts an attacker-controlled URL and convinces an administrator to bookmark it plants the payload with no further interaction — and the resulting permalink fires for every visitor including the administrator on first save, providing a one-shot administrator account takeover. Version 0.16.3 fixes the issue.