CVE-2025-66036: Retro is vulnerable to XSS vulnerability in input handling component
Published Nov 29, 2025
·Updated
Retro is an online platform providing items of vintage collections. Prior to version 2.4.7, Retro is vulnerable to a cross-site scripting (XSS) in the input handling component. This issue has been patched in version 2.4.7.
Affected Software
1 affected component
Retro Retro<2.4.7
Event History
Nov 29, 2025
CVE Published
via MITRE·01:14 AM
Data Sourced
via MITRE·01:14 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-66036?
CVE-2025-66036 has a medium severity rating due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2025-66036?
To fix CVE-2025-66036, upgrade to Retro version 2.4.7 or later.
3
What components are affected by CVE-2025-66036?
CVE-2025-66036 affects the input handling component of the Retro platform.
4
What types of vulnerabilities does CVE-2025-66036 represent?
CVE-2025-66036 represents a cross-site scripting (XSS) vulnerability.
5
Is there a patch available for CVE-2025-66036?
Yes, a patch for CVE-2025-66036 is included in version 2.4.7 of Retro.