CVE-2025-59945: high-severity vulnerability in Syslifters sysreptor
SysReptor Susceptible to Privilege Escalation by Authenticated Users
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.3%
SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Syslifters · sysreptorRelated CVEs — Syslifters sysreptor
In the same product, most dangerous first.
CVE-2026-81180HIGHSysReptor: Authenticated RCE by insecure image processingEPSS 0.7%CVE-2026-81179HIGHSysReptor: Host header injection might allow account takeoverEPSS 0.5%CVE-2026-81178LOWSysReptor: Anonymous note-share link discloses project member identities and non-shared note activityEPSS 0.3%CVE-2026-81181LOWSysReptor: Session Fixation in Password-Protected Shared NotesEPSS 0.3%CVE-2026-81182MEDIUMSysReptor: Unauthorized file disclosure by broken access control in writable shared notesEPSS 0.3%CVE-2025-66561HIGHSysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS)EPSS 0.2%