CVE-2025-66561

SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.

CVSS v3 7.3 HIGH

7.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Syslifters/sysreptor/security/advisories/GHSA-64vw-v5c4-mgvm	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:syslifters:sysreptor:*:*:*:*:*:*:*:*

History

18 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) SysReptor es una plataforma de informes de pentesting totalmente personalizable. Versiones anteriores a 2025.102, existe una vulnerabilidad de cross-site scripting (XSS) almacenado que permite a los usuarios autenticados ejecutar JavaScript malicioso en el contexto de otros usuarios con sesión iniciada al subir archivos JavaScript maliciosos en la interfaz de usuario web. Esta vulnerabilidad está corregida en 2025.102.

Information

Published : 2025-12-04 23:15

Updated : 2026-10-18 15:10

NVD link : CVE-2025-66561

Mitre link : CVE-2025-66561

CVE.ORG link : CVE-2025-66561

JSON object : View

Products Affected

syslifters

sysreptor

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-66561", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66561", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-12-05T17:28:31.799698Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Syslifters", "product": "sysreptor", "versions": [{"status": "affected", "version": "< 2025.102"}]}]}], "published": "2025-12-04T23:15:47.107", "references": [{"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-64vw-v5c4-mgvm", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102."}, {"lang": "es", "value": "SysReptor es una plataforma de informes de pentesting totalmente personalizable. Versiones anteriores a 2025.102, existe una vulnerabilidad de cross-site scripting (XSS) almacenado que permite a los usuarios autenticados ejecutar JavaScript malicioso en el contexto de otros usuarios con sesi\u00f3n iniciada al subir archivos JavaScript maliciosos en la interfaz de usuario web. Esta vulnerabilidad est\u00e1 corregida en 2025.102."}], "lastModified": "2026-10-18T15:10:00.097", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:syslifters:sysreptor:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FA895A6-D084-4A74-AE1F-8E998D5BC747", "versionEndExcluding": "2025.102"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}