{"id":"EUVD-2025-199921","enisaUuid":"6ac6d459-6393-3e2e-ad31-122cf95d732e","description":"Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.","datePublished":"Nov 30, 2025, 12:00:00 AM","dateUpdated":"Dec 1, 2025, 2:10:50 PM","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://discuss.tryton.org/t/security-release-for-issue-14290/8895\nhttps://foss.heptapod.net/tryton/tryton/-/issues/14290\n","aliases":"CVE-2025-66420\nGHSA-xhgv-99mj-8m2x\n","assigner":"mitre","epss":0.18,"enisaIdProduct":[{"id":"3cc4305f-3f05-39df-bf41-6fe760513270","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.0.0 \u003c7.0.38"},{"id":"aeeae73a-cb78-3855-96e3-820b4f9c0f5d","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.1.0 \u003c7.4.19"},{"id":"b3d10a97-61d0-3c7f-bc48-a184fe427737","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"0 \u003c6.0.67"},{"id":"c7ea61d3-bf36-3397-aaec-b3eabc84714e","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.5.0 \u003c7.6.9"}],"enisaIdVendor":[{"id":"a6a01359-447f-3fda-9a0d-f97049f79b4f","vendor":{"name":"tryton"}}],"enisaIdVulnerability":[{"id":"4894ea99-d921-347e-8e4e-3ae001d19064","vulnerability":{"id":"GHSA-xhgv-99mj-8m2x","description":"Tryton sao allows XSS via an HTML attachment","datePublished":"Nov 30, 2025, 3:30:26 AM","dateUpdated":"Dec 2, 2025, 12:31:41 AM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-66420\nhttps://discuss.tryton.org/t/security-release-for-issue-14290/8895\nhttps://foss.heptapod.net/tryton/tryton/-/issues/14290\nhttps://github.com/tryton/sao\n","enisa_id":"EUVD-2025-199921\n","aliases":"CVE-2025-66420\nGHSA-xhgv-99mj-8m2x\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a02fe80b-2c36-3ebe-8377-2bedfe39d15e","vulnerability":{"id":"CVE-2025-66420","description":"Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.","datePublished":"Nov 30, 2025, 12:00:00 AM","dateUpdated":"Dec 1, 2025, 2:10:50 PM","status":"PUBLISHED","baseScore":5.4,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","references":"https://discuss.tryton.org/t/security-release-for-issue-14290/8895\nhttps://foss.heptapod.net/tryton/tryton/-/issues/14290\n","enisa_id":"EUVD-2025-199921\n","assigner":"mitre","epss":0.18,"dataProcessed":"Nov 1, 2026, 4:09:05 AM","vulnerabilityProduct":[{"id":"77dc11a9-6540-3d18-b609-1a00155c1a6f","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.0.0 \u003c7.0.38"},{"id":"96c6030d-a61e-3194-b91e-cd1d7784c38f","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.5.0 \u003c7.6.9"},{"id":"aabcc86c-78d7-3cf9-a157-561c000d5d98","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"7.1.0 \u003c7.4.19"},{"id":"c0e38624-d35b-3a30-913f-bcc5ffe81e00","product":{"name":"sao","vendor":{"name":"tryton"}},"product_version":"0 \u003c6.0.67"}],"vulnerabilityVendor":[{"id":"faac6739-5367-3bdf-b0e9-3897b14bb3d1","vendor":{"name":"tryton"}}]}}],"enisaIdAdvisory":[]}