PT-2025-48752 · Lookyloo · Lookyloo

Published 2025-12-02 · Updated 2025-12-05 · CVE-2025-66459

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lookyloo versions prior to 1.35.3

Description Lookyloo is a web interface used to capture website pages and display a tree of domains that interact with each other. A cross-site scripting (XSS) issue can occur when a user submits URLs for capture, including one containing a HTML element that causes the capture to fail. The resulting error message, which includes the problematic URL, is then displayed without proper sanitization, leading to XSS. The issue is triggered when the error field is populated with the bad URL.

Recommendations Update Lookyloo to version 1.35.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66459

GHSA-HVMH-J2JX-48WG

Affected Products

Lookyloo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66459.json · Exploit
• https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-hvmh-j2jx-48wg · Vendor Advisory
• https://github.com/Lookyloo/lookyloo/commit/1850a34b8cec52438df3b544295b20cfa35f8ad1 · Patch
• https://github.com/Lookyloo/lookyloo/commit/8c3ab96de44c1ce15646d734aa06faf884329116 · Patch
• https://github.com/Lookyloo/lookyloo/commit/95cdc00fe37fd89790fa89bb3ee3fefa2da38442 · Patch
• https://osv.dev/vulnerability/CVE-2025-66459 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66459 · Security Note
• https://t.me/CVEtracker/38711 · Telegram Post
• https://twitter.com/dailycve/status/1996997258651279444 · Twitter Post