← Database

CVE-2025-25477

HIGH CVSS: 8.1 Published: 2025-02-28 Modified: 2026-06-17

Description

A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser.

Affected Platforms

Syspass Syspass

Weakness Type

CWE-74

References