PT-2025-48753 · Lookyloo · Lookyloo

Published 2025-12-02 · Updated 2025-12-05 · CVE-2025-66460

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lookyloo versions prior to 1.35.3

Description Lookyloo is a web interface used to capture and display a tree of domains that interact with each other. Versions of Lookyloo prior to 1.35.3 improperly escape values passed to cells rendered in datatables using the orthogonal-data feature, leading to a potential security issue. This issue is exploitable in the popup view and potentially in other areas of the application. The vulnerability involves passing values to datatables without proper sanitization, which could allow for malicious code execution.

Recommendations Update Lookyloo to version 1.35.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66460

GHSA-R93R-7JFR-99C3

Affected Products

Lookyloo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66460.json · Exploit
• https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-r93r-7jfr-99c3 · Vendor Advisory
• https://github.com/Lookyloo/lookyloo/commit/63b39311f6b251a671895d97174345faf1b18e6e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-66460 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66460 · Vendor Advisory
• https://t.me/CVEtracker/38712 · Telegram Post
• https://twitter.com/dailycve/status/1996996036691189832 · Twitter Post