GHSA-6qj9-2g9m-29x9Published
Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2025-66421 · Microsoft / collected KEV context
cve-program · CVE-2025-66421
- https://discuss.tryton.org/t/security-release-for-issue-14363/8951
- https://foss.heptapod.net/tryton/tryton/-/issues/14363
euvd · EUVD-2025-199920
- https://discuss.tryton.org/t/security-release-for-issue-14363/8951
- https://foss.heptapod.net/tryton/tryton/-/issues/14363
nvd · CVE-2025-66421
- https://discuss.tryton.org/t/security-release-for-issue-14363/8951
- https://foss.heptapod.net/tryton/tryton/-/issues/14363
osv · GHSA-6qj9-2g9m-29x9
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.