{"id":"EUVD-2025-199920","enisaUuid":"82d23167-3ce3-32fd-a82d-88137b2b9763","description":"Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.","datePublished":"Nov 30, 2025, 12:00:00 AM","dateUpdated":"Dec 1, 2025, 2:10:45 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://discuss.tryton.org/t/security-release-for-issue-14363/8951\nhttps://foss.heptapod.net/tryton/tryton/-/issues/14363\n","aliases":"CVE-2025-66421\nGHSA-6qj9-2g9m-29x9\n","assigner":"mitre","epss":0.18,"enisaIdProduct":[{"id":"22ed608c-d8a4-30c8-a6ae-cc960085d903","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.5.0 \u003c7.6.11"},{"id":"3533bf96-ac3c-3ec8-8a84-5d543b363488","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.1.0 \u003c7.4.21"},{"id":"887a7c09-20e4-337c-9704-3864ba15f274","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"0 \u003c6.0.69"},{"id":"cc47e568-e938-3e93-a202-57fb544e0d9f","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.0.0 \u003c7.0.40"}],"enisaIdVendor":[{"id":"52209c66-0b86-324a-918a-9d4e23181a50","vendor":{"name":"tryton"}}],"enisaIdVulnerability":[{"id":"0843a30d-bf19-3edd-a656-961f2963c64b","vulnerability":{"id":"CVE-2025-66421","description":"Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.","datePublished":"Nov 30, 2025, 12:00:00 AM","dateUpdated":"Dec 1, 2025, 2:10:45 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://discuss.tryton.org/t/security-release-for-issue-14363/8951\nhttps://foss.heptapod.net/tryton/tryton/-/issues/14363\n","enisa_id":"EUVD-2025-199920\n","assigner":"mitre","epss":0.18,"dataProcessed":"Nov 11, 2026, 7:26:12 AM","vulnerabilityProduct":[{"id":"2ea4c620-1663-3ba1-a492-84f1c33d1171","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.5.0 \u003c7.6.11"},{"id":"40ea1546-7059-3301-9eec-d6b3ca56146e","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"0 \u003c6.0.69"},{"id":"66f5c64a-937e-3ff8-83b4-3eca90b31ac3","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.1.0 \u003c7.4.21"},{"id":"f103e468-3e39-3f17-9525-46019c9bb876","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.0.0 \u003c7.0.40"}],"vulnerabilityVendor":[{"id":"e7cf7e2d-7b74-34af-b02c-ba93fd58839b","vendor":{"name":"tryton"}}]}},{"id":"f18510eb-f464-346e-afcd-bd7a5b0439f1","vulnerability":{"id":"GHSA-6qj9-2g9m-29x9","description":"Tryton sao allows XSS because it does not escape completion values","datePublished":"Nov 30, 2025, 3:30:26 AM","dateUpdated":"Dec 2, 2025, 12:31:24 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-66421\nhttps://discuss.tryton.org/t/security-release-for-issue-14363/8951\nhttps://foss.heptapod.net/tryton/tryton/-/issues/14363\nhttps://github.com/tryton/sao\n","enisa_id":"EUVD-2025-199920\n","aliases":"CVE-2025-66421\nGHSA-6qj9-2g9m-29x9\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:44:24 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}