SysReptor CVE-2025-66561

Exploitation requires the attacker to (1) hold valid authenticated credentials to the SysReptor web UI with permission to upload files, and (2) a separate logged-in victim must subsequently view the content where the malicious JavaScript file is rendered/served, triggering execution in the victim's browser (UI:R). The payload is delivered specifically via the file-upload feature of the web UI. Limiting factors: this is NOT remote-unauthenticated - PR:L means an account is mandatory - and the user-interaction requirement means no impact occurs until a victim opens the stored content, so the realistic threat is privilege escalation or session theft against other application users rather than direct server compromise. Confidentiality/integrity impact is limited (C:L/I:L) and there is no availability impact.

This is a genuinely moderate, not high, priority. The CVSS 3.1 base score of 5.4 (vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) tells a consistent story: network-reachable but requiring an authenticated user (PR:L) to upload a malicious JavaScript file and a victim to view it (UI:R), yielding limited confidentiality and integrity impact with a scope change (S:C) because the injected script executes in another logged-in user's browser context. All exploitation signals point low: EPSS is 0.04% (13th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no confirmed active exploitation. No SSVC decision data was supplied. The signals do not conflict: a stored XSS requiring valid authentication plus victim interaction, in a niche pentest-reporting tool, is a real but bounded issue best handled through routine patching rather than emergency response. The primary escalation concern is privilege escalation within the application - e.g., a lower-privileged user coercing an administrator's session.

An authenticated SysReptor user (e.g., a junior tester or a compromised low-privilege account) uploads a file containing malicious JavaScript through the web UI. When another logged-in user - such as a project lead or administrator - views the content, the stored script executes in their browser session, enabling session/token theft or actions performed as the victim. No public proof-of-concept is referenced, and exploitation depends on the attacker already holding valid credentials.