What is the CVSS score of CVE-2025-66561?

CVE-2025-66561 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Sysreptor are affected by CVE-2025-66561?

SysReptor versions prior to 2025.102 contain a stored XSS vulnerability that allows authenticated users to inject malicious JavaScript affecting other users of the pentest reporting platform,…. A patch is available.

How to fix or mitigate CVE-2025-66561?

Within 24 hours: Identify all SysReptor instances and document current versions. Within 7 days: Upgrade all SysReptor deployments to version 2025.102 or later; test file upload restrictions in staging environment before production deployment. Within 30 days: Conduct audit of file uploads from past 90 days and review access logs for suspicious JavaScript file uploads; implement additional input validation on uploaded files.

Sysreptor CVE-2025-66561

EUVD-2025-201321 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-12-04 security-advisories@github.com

XSS Sysreptor Syslifters

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:23 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2025.102

EUVD ID Assigned

Mar 15, 2026 - 16:35 euvd

EUVD-2025-201321

Analysis Generated

Mar 15, 2026 - 16:35 vuln.today

CVE Published

Dec 04, 2025 - 23:15 nvd

HIGH 7.3

DescriptionGitHub Advisory

SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.