{"id":"EUVD-2025-199921","revision":"dce99b7afb33449685297a9ba668ac5a","records":[{"revision":"dce99b7afb33449685297a9ba668ac5a","observedAt":"2026-11-05T05:06:45.377+00:00","statement":{"source":"euvd","id":"EUVD-2025-199921","aliases":["CVE-2025-66420","GHSA-xhgv-99mj-8m2x"],"title":"Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.","description":"Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4,"severity":null}],"references":["https://discuss.tryton.org/t/security-release-for-issue-14290/8895","https://foss.heptapod.net/tryton/tryton/-/issues/14290"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-199921","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 30, 2025, 12:00:00 AM","dateUpdated":"Dec 1, 2025, 2:10:50 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-199921","identifiers":["EUVD-2025-199921","CVE-2025-66420","GHSA-xhgv-99mj-8m2x"]},"retained":false,"historicalAffected":[]}],"coverage":[]}