PT-2025-39430 · Unknown · Vulnerability-Lookup

Published 2025-09-25 · Updated 2025-09-26 · CVE-2025-60249

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions vulnerability-lookup version 2.16.0

Description A cross-site scripting (XSS) issue exists in the handling of user-supplied input within the Bundles, Comments, and Sightings components of the software. Untrusted data was not properly sanitized before being rendered, potentially allowing attackers to inject arbitrary JavaScript into the application. The root cause was the unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. The affected files include bundle.py, comment.py, and user.py. An attacker who can add bundles, comments, or sightings to a vulnerability-lookup instance can exploit this issue.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-60249

Affected Products

Vulnerability-Lookup

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-60249 · Security Note
• https://osv.dev/vulnerability/CVE-2025-60249 · Vendor Advisory
• https://github.com/vulnerability-lookup/vulnerability-lookup/commit/afa12347f1461d9481eba75ac19897e80a9c7434 · Note
• https://twitter.com/CVEnew/status/1971266268540854672 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971427694458851478 · Twitter Post
• https://t.me/CVEtracker/33359 · Telegram Post