Vulnerability Description
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lookyloo | Lookyloo | < 1.35.3 |
Related Weaknesses (CWE)
References
- https://github.com/Lookyloo/lookyloo/commit/1850a34b8cec52438df3b544295b20cfa35fPatch
- https://github.com/Lookyloo/lookyloo/commit/8c3ab96de44c1ce15646d734aa06faf88432Patch
- https://github.com/Lookyloo/lookyloo/commit/95cdc00fe37fd89790fa89bb3ee3fefa2da3Patch
- https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-hvmh-j2jx-48wgPatchVendor Advisory
FAQ
What is CVE-2025-66459?
CVE-2025-66459 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submi...
How severe is CVE-2025-66459?
CVE-2025-66459 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-66459?
Check the references section above for vendor advisories and patch information. Affected products include: Lookyloo Lookyloo.