CVE-2025-60249

vulnerability-lookup 2.16.0 allows XSS in bundle.py, comment.py, and user.py, by a user on a vulnerability-lookup instance who can add bundles, comments, or sightings. A cross-site scripting (XSS) vulnerability was discovered in the handling of user-supplied input in the Bundles, Comments, and Sightings components. Untrusted data was not properly sanitized before being rendered in templates and tables, which could allow attackers to inject arbitrary JavaScript into the application. The issue was due to unsafe use of innerHTML and insufficient validation of dynamic URLs and model fields. This vulnerability has been fixed by escaping untrusted data, replacing innerHTML assignments with safer DOM methods, encoding URLs with encodeURIComponent, and improving input validation in the affected models.

• CWE-79

• https://github.com/vulnerability-lookup/vulnerability-lookup/commit/afa12347f1461d9481eba75ac19897e80a9c7434

Published

Sep 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-60243Incorrect Privilege Assignment vulnerability in Holest Engin…9.8
• CVE-2025-60244Improper Neutralization of Script-Related HTML Tags in a Web…7.1
• CVE-2025-60245Deserialization of Untrusted Data vulnerability in WP User M…9.8
• CVE-2025-60246Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2025-60247Missing Authorization vulnerability in Bux Bux Woocommerce b…6.5
• CVE-2025-60248Improper Control of Filename for Include/Require Statement i…7.5
• CVE-2025-6025The Order Tip for WooCommerce plugin for WordPress is vulner…7.5
• CVE-2025-60250Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decry…4.7
• CVE-2025-60251Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accep…5
• CVE-2025-6026An improper certificate validation vulnerability was reporte…3.1
• CVE-2025-60262An issue in H3C M102G HM1A0V200R010 wireless controller and …9.8
• CVE-2025-60265In xckk v9.6, there is a SQL injection vulnerability in whic…6.5