CVE-2025-66421

Summary

Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.

Affected Software

VendorProductVersion RangeStatus
Trytonsao0 < 6.0.69affected
Trytonsao7.0.0 < 7.0.40affected
Trytonsao7.1.0 < 7.4.21affected
Trytonsao7.5.0 < 7.6.11affected

Weaknesses

  • CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References