CVE-2025-66420

MediumCVSS 5.4

Published: 30/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.

Risk Assessment

The risk includes the possibility of executing malicious scripts in the user's browser after opening an attachment, which could lead to data theft or session hijacking. This may compromise the security of the application and organizational data.

Recommendation

It is recommended to upgrade tryton-sao to one of the patched versions. Also, inform users about the risk of opening unknown attachments.

Other vulnerabilities in Tryton sao

CVE-2025-66421Medium
Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.

Original NVD description (English source)

Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS