CVE-2025-66458: falha de média gravidade em lookyloo
Lookyloo has multiple XSS due to unsafe use of f-strings in Markup
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, there are multiple XSS due to unsafe use of f-strings in Markup. The issue requires a malicious 3rd party server responding with a JSON document containing JS code in a script element. This vulnerability is fixed in 1.35.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
Lookyloo · lookylooCVEs relacionadas — lookyloo
No mesmo produto, das mais perigosas para as menos.
CVE-2025-65095CRITICALLookyloo is vulnerable due to improper user input sanitizationEPSS 0.4%CVE-2026-55835MEDIUMLookyloo: Potential sub-system DoS due to parameter missmatch in notificationEPSS 0.4%CVE-2025-66459MEDIUMLookyloo vulnerable to XSS due to unescaped error message passed to innerHTMLEPSS 0.3%CVE-2025-66460MEDIUMLookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to DatatablesEPSS 0.2%