CVE-2025-25477: High severity sysPass SysPass vulnerability
A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25477?
CVE-2025-25477 is considered a medium severity vulnerability due to its potential to allow attackers to execute malicious JavaScript in victims' browsers.
How do I fix CVE-2025-25477?
To mitigate CVE-2025-25477, users should upgrade SysPass to version 3.3.0 or higher, which addresses this host header injection issue.
Who is affected by CVE-2025-25477?
CVE-2025-25477 affects users of SysPass versions 3.2.0 to 3.2.x.
What kind of attack is associated with CVE-2025-25477?
CVE-2025-25477 is associated with host header injection attacks that can lead to the execution of malicious scripts.
Is CVE-2025-25477 remotely exploitable?
Yes, CVE-2025-25477 is remotely exploitable, allowing attackers to load harmful scripts from an arbitrary domain.