CVE-2024-36076

The SysReptor offensive security reporting solution is vulnerable to Cross-Site WebSocket Hijacking in versions 2024.28 through 2024.30 (and other versions prior to 2024.40 ). This vulnerability allows an attacker to escalate privileges and obtain sensitive information when a logged-in user visit...

CVE-2025-59945

Vulnerability summary (CVE-2025-59945): SysReptor (Syslifters) versions 2024.74 through 2025.82 allow authenticated, non-admin users to grant themselves the is_project_admin privilege, enabling reading, modifying, and deleting pentest projects they are not members of. This is mitigated in version...

CVE-2025-66561

CVE-2025-66561 affects SysReptor (Syslifters) prior to version 2025.102, exposing an authenticated Stored Cross-Site Scripting (XSS) vulnerability. An attacker can upload malicious JavaScript in the web UI, and execute it in the context of other logged-in users. The issue is fixed in 2025.102. Ex...