CVE-2025-66561: high-severity vulnerability in Syslifters sysreptor
SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.3epss 0.2%
SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected products
Syslifters · sysreptorRelated CVEs — Syslifters sysreptor
In the same product, most dangerous first.
CVE-2026-81180HIGHSysReptor: Authenticated RCE by insecure image processingEPSS 0.7%CVE-2026-81179HIGHSysReptor: Host header injection might allow account takeoverEPSS 0.5%CVE-2025-59945HIGHSysReptor Susceptible to Privilege Escalation by Authenticated UsersEPSS 0.3%CVE-2026-81178LOWSysReptor: Anonymous note-share link discloses project member identities and non-shared note activityEPSS 0.3%CVE-2026-81181LOWSysReptor: Session Fixation in Password-Protected Shared NotesEPSS 0.3%CVE-2026-81182MEDIUMSysReptor: Unauthorized file disclosure by broken access control in writable shared notesEPSS 0.3%