CVE-2025-66460CWE-79cross-site-scripting

CVE-2025-66460

Medium · published December 3, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
8.0
In the wild
Unconfirmed
What it is

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00188 · 8.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-03T00:15Z
Affected products (1)
ProductVersionsFixed in
lookyloo/lookyloo< 1.35.31.35.3
References (2)
https://github.com/Lookyloo/lookyloo/commit/63b39311f6b251a671895d97174345faf1b18e6e · [email protected]https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-r93r-7jfr-99c3 · [email protected]
EPSS history
Timeline
  • 02 DEC 18:34Z
    Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables
    cvelistv5