CVE-2025-66459CWE-79cross-site-scripting

CVE-2025-66459

Medium · published December 3, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
22.4
In the wild
Unconfirmed
What it is

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00308 · 22.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-03T00:15Z
Affected products (1)
ProductVersionsFixed in
lookyloo/lookyloo< 1.35.31.35.3
References (4)
https://github.com/Lookyloo/lookyloo/commit/1850a34b8cec52438df3b544295b20cfa35f8ad1 · [email protected]https://github.com/Lookyloo/lookyloo/commit/8c3ab96de44c1ce15646d734aa06faf884329116 · [email protected]https://github.com/Lookyloo/lookyloo/commit/95cdc00fe37fd89790fa89bb3ee3fefa2da38442 · [email protected]https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-hvmh-j2jx-48wg · [email protected]
EPSS history
Timeline
  • 02 DEC 18:32Z
    Lookyloo vulnerable to XSS due to unescaped error message passed to innerHTML
    cvelistv5