Stored XSS via raw bookmark title

Stored XSS in Shaarli before 0.16.3 allows remote attackers to execute script in visitors' browsers via a crafted bookmark title. In application/front/controller/visitor/BookmarkListController.php, the permalink handler copies bookmark title data into the pagetitle template variable, and the RainTPL includes template emits that value inside the document title without HTML escaping, so a closing title tag and script payload execute in the Shaarli origin. Exploitation requires getting an administrator to save a bookmark with an attacker-controlled title, including by bookmarking an attacker-hosted page whose remote title is imported verbatim, after which visits to /shaare/{hash} run the stored payload and can expose the administrator session.