CVE-2025-59945 SysReptor Susceptible to Privilege Escalation by Authenticated Users

SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged non-admin users can assign the isprojectadmin permission to their own user. This allows users to read, modify and delete pentesting projects they are not member...

CVE-2025-59945 SysReptor Susceptible to Privilege Escalation by Authenticated Users

SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged non-admin users can assign the isprojectadmin permission to their own user. This allows users to read, modify and delete pentesting projects they are not member...

CVE-2025-59945

Vulnerability summary (CVE-2025-59945): SysReptor (Syslifters) versions 2024.74 through 2025.82 allow authenticated, non-admin users to grant themselves the is_project_admin privilege, enabling reading, modifying, and deleting pentest projects they are not members of. This is mitigated in version...

Syslifters Sysreptor 安全漏洞

Syslifters Sysreptor is a penetration test reporting platform from Syslifters, Inc. A security vulnerability exists in Syslifters Sysreptor versions 2024.74 through prior to 2025.83, which stems from allowing an unprivileged user to assign the isprojectadmin privilege, which could lead to...

CVE-2025-59945: Incorrect Privilege Assignment

SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged non-admin users can assign the isprojectadmin permission to their own user. This allows users to read, modify and delete pentesting projects they are not member...

CVE-2024-36076

Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session...

CVE-2024-36076

Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session...

CVE-2024-36076

The SysReptor offensive security reporting solution is vulnerable to Cross-Site WebSocket Hijacking in versions 2024.28 through 2024.30 (and other versions prior to 2024.40 ). This vulnerability allows an attacker to escalate privileges and obtain sensitive information when a logged-in user visit...

CVE-2024-36076

Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session...

CVE-2024-36076

Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session...

CVE-2024-36076

Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session...

PT-2024-26885

Name of the Vulnerable Software and Affected Versions SysReptor versions 2024.28 through 2024.30 SysReptor versions prior to 2024.40 Description The issue allows attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomai...

Syslifters SysReptor 安全漏洞

Syslifters SysReptor is a fully customizable offensive security reporting solution from Syslifters. A security vulnerability exists in Syslifters SysReptor versions prior to 2024.40 that stems from the presence of a cross-site request forgery vulnerability...

CVE-2024-36076: Cross-Site Request Forgery (CSRF)

Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session...

Sysreptor - Fully Customisable, Offensive Security Reporting Tool Designed For Pentesters, Red Teamers And Other Security-Related People Alike

Easy and customisable pentest report creator based on simple web technologies. SysReptor is a fully customisable, offensive security reporting tool designed for pentesters, red teamers and other security-related people alike. You can create designs based on simple HTML and CSS, write your reports...