PT-2025-48354 · Retro · Retro

Published 2025-11-29 · Updated 2026-01-29 · CVE-2025-66036

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Retro versions prior to 2.4.7

Description Retro, an online platform for vintage collections, has a cross-site scripting (XSS) issue in the input handling component. This allows for potential malicious code execution through crafted input.

Recommendations Update to version 2.4.7 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66036

Affected Products

Retro

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-66036 · Security Note
• https://github.com/Anjaliavv51/Retro/security/advisories/GHSA-gvv6-p6h6-2vj2 · Note
• https://t.me/CVEtracker/38451 · Telegram Post
• https://twitter.com/UndercodeUpdate/status/2016832488677519490 · Twitter Post