PT-2025-47512 · Lookyloo · Lookyloo

Published 2025-11-19 · Updated 2025-11-20 · CVE-2025-65095

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Lookyloo versions prior to 1.35.1

Description Lookyloo, a web interface for capturing website pages and displaying domain call trees, contains a potential cross-site scripting issue on the index and tree pages. This allows for full DOM takeover through unsanitized user input.

Recommendations Update to version 1.35.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65095

GHSA-M9G6-23C8-VRXF

Affected Products

Lookyloo

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65095.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65095 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65095 · Vendor Advisory
• https://github.com/Lookyloo/lookyloo/blob/main/website/web/default_csp.py · Note
• https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-m9g6-23c8-vrxf · Note
• https://github.com/Lookyloo/lookyloo/commit/ac2f73dbfcad88b815b18c42cca77a1c645f1726 · Note
• https://twitter.com/0dayPublishing/status/1991203550219616740 · Twitter Post
• https://twitter.com/CVEnew/status/1991409474075083133 · Twitter Post
• https://vulnerability.circl.lu/vuln/gcve-1-2025-0018 · Note
• https://t.me/CVEtracker/37772 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991240562616217818 · Twitter Post