CVE-2025-25477: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...

CVE-2025-25477

creationtimestamp| type| source ---|---|--- 2025-02-27 23:25:33+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/5812 2025-02-28 01:53:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lj7ccv5fxx2w 2025-02-28 03:38:48+00:00| seen|...

CVE-2025-25477

A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...