What’s Vulnerable › Vulnerabilities

CVE-2025-66420

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-30 · updated 2026-10-07
• Weakness: CWE-79

Description

Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.

Affected products

• Tryton sao: before 6.0.67; from 7.0.0 before 7.0.38; from 7.1.0 before 7.4.19; from 7.5.0 before 7.6.9 — fixed in 6.0.67, 7.0.38, 7.4.19, 7.6.9

How to fix

Upgrade to a fixed version: Tryton sao 6.0.67, 7.0.38, 7.4.19, 7.6.9. Check the vendor advisory for mitigations.

References

• https://discuss.tryton.org/t/security-release-for-issue-14290/8895
• https://foss.heptapod.net/tryton/tryton/-/issues/14290

Get alerted when CVE-2025-66420 or the next vulnerability affects your stack