A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or notification component.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25476 | Exploit Third Party Advisory |
| https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25476 | Exploit Third Party Advisory |
Configurations
History
09 Jul 2025, 19:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:syspass:syspass:*:*:*:*:*:*:*:* | |
| References | () https://github.com/sysentr0py/CVEs/tree/main/CVE-2025-25476 - Exploit, Third Party Advisory | |
| First Time |
Syspass syspass
Syspass |
28 Feb 2025, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-02-28 23:15
Updated : 2025-07-09 19:30
NVD link : CVE-2025-25476
Mitre link : CVE-2025-25476
JSON object : View
Products Affected
syspass
- syspass
CWE
No CWE.