Search
Find a vulnerability
Search criteria
20 vulnerabilities by syslifters
CVE-2026-81182 (GCVE-0-2026-81182)
Vulnerability from nvd – Published: 2026-09-18 17:48 – Updated: 2026-09-24 21:05
VLAI
EPSS
VEX
Title
SysReptor: Unauthorized file disclosure by broken access control in writable shared notes
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 21:02 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/1b… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/1f… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/f7… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.68
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81182",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T21:02:34.359694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T21:05:26.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.68"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:48:05.575Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-x3m3-v8pv-442r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-x3m3-v8pv-442r"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/1b721e291ebadfc1457bc8d01f7c70fe5da4b035",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/1b721e291ebadfc1457bc8d01f7c70fe5da4b035"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/1f3fd629c32560fc4280294f8f9bdc44d97c639a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/1f3fd629c32560fc4280294f8f9bdc44d97c639a"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/f730c3acf9ee603f96bb05d598d20f6c4e958eb8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/f730c3acf9ee603f96bb05d598d20f6c4e958eb8"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.68",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.68"
}
],
"source": {
"advisory": "GHSA-x3m3-v8pv-442r",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Unauthorized file disclosure by broken access control in writable shared notes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81182",
"datePublished": "2026-09-18T17:48:05.575Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-24T21:05:26.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81181 (GCVE-0-2026-81181)
Vulnerability from nvd – Published: 2026-09-18 17:48 – Updated: 2026-09-21 20:48
VLAI
EPSS
VEX
Title
SysReptor: Session Fixation in Password-Protected Shared Notes
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor session cookie, place it in a victim's browser, and know the shared-note URL where the victim authenticates can reuse the fixed session after the victim enters the correct password and access that shared note. The main SysReptor login flow is not affected. This issue is fixed in version 2026.68.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:30 UTC
CWE
- CWE-384 - Session Fixation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/19… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.68
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81181",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:30:39.522705Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:48:45.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.68"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor session cookie, place it in a victim\u0027s browser, and know the shared-note URL where the victim authenticates can reuse the fixed session after the victim enters the correct password and access that shared note. The main SysReptor login flow is not affected. This issue is fixed in version 2026.68."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-384",
"description": "CWE-384: Session Fixation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:48:53.253Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wgx3-84xg-q93j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wgx3-84xg-q93j"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/1981717f15afe945aa86d7e0dc9dc30a30c88dea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/1981717f15afe945aa86d7e0dc9dc30a30c88dea"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.68",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.68"
}
],
"source": {
"advisory": "GHSA-wgx3-84xg-q93j",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Session Fixation in Password-Protected Shared Notes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81181",
"datePublished": "2026-09-18T17:48:53.253Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-21T20:48:45.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81180 (GCVE-0-2026-81180)
Vulnerability from nvd – Published: 2026-09-18 17:47 – Updated: 2026-09-22 15:15
VLAI
EPSS
VEX
Title
SysReptor: Authenticated RCE by insecure image processing
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:15 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/7d… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/7e… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/e8… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/f2… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/f5… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.61
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81180",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:15:18.561499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:15:32.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.61"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:47:02.134Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wmf3-gv8j-7qp7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wmf3-gv8j-7qp7"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/7d800e5c737df0dbc3d4ea2d095c89235790a1cc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/7d800e5c737df0dbc3d4ea2d095c89235790a1cc"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/e8bd31cb42a15a10bb5102337b55dde704be397f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/e8bd31cb42a15a10bb5102337b55dde704be397f"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/f27760961943fb1716cbb68f2a6705e7251b4e5c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/f27760961943fb1716cbb68f2a6705e7251b4e5c"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/f5ad35b9e71d370b5e06ef4680979cb05c24ff3c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/f5ad35b9e71d370b5e06ef4680979cb05c24ff3c"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.61",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.61"
}
],
"source": {
"advisory": "GHSA-wmf3-gv8j-7qp7",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Authenticated RCE by insecure image processing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81180",
"datePublished": "2026-09-18T17:47:02.134Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-22T15:15:32.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81179 (GCVE-0-2026-81179)
Vulnerability from nvd – Published: 2026-09-18 17:45 – Updated: 2026-09-18 19:49
VLAI
EPSS
VEX
Title
SysReptor: Host header injection might allow account takeover
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:49 UTC
CWE
- CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/7e… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.58
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81179",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:49:37.146667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:49:53.040Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.58"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim\u0027s password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:45:58.249Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-9x2r-5pff-8w6c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-9x2r-5pff-8w6c"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.58",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.58"
}
],
"source": {
"advisory": "GHSA-9x2r-5pff-8w6c",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Host header injection might allow account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81179",
"datePublished": "2026-09-18T17:45:58.249Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-18T19:49:53.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81178 (GCVE-0-2026-81178)
Vulnerability from nvd – Published: 2026-09-18 17:44 – Updated: 2026-09-18 18:03
VLAI
EPSS
VEX
Title
SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 18:03 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/1e… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.55
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T18:03:32.395858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T18:03:40.523Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.55"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:44:42.562Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-926c-j47w-8f9c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-926c-j47w-8f9c"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/1e52e5058b0c7f420dc45c87ad72e7a4585477b1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/1e52e5058b0c7f420dc45c87ad72e7a4585477b1"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.55"
}
],
"source": {
"advisory": "GHSA-926c-j47w-8f9c",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81178",
"datePublished": "2026-09-18T17:44:42.562Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-18T18:03:40.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44987 (GCVE-0-2026-44987)
Vulnerability from nvd – Published: 2026-05-08 21:59 – Updated: 2026-05-12 18:31
VLAI
EPSS
VEX
Title
SysReptor: Privilege Escalation from User Admin to Superuser
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves "Project Admin" permissions. This is intentional and by design. This issue has been patched in version 2026.29.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 13:00 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.29
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44987",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T13:00:12.318338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T18:31:48.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.29"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with \"User Admin\" permissions can change the email addresses of users with \"Superuser\" permissions. If the SysReptor installation has the \"Forgot Password\" functionality enabled (non-default), they can reset the Superusers\u0027 passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves \"Project Admin\" permissions. This is intentional and by design. This issue has been patched in version 2026.29."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T21:59:12.204Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.29",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.29"
}
],
"source": {
"advisory": "GHSA-6x8f-v3cf-cvr3",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Privilege Escalation from User Admin to Superuser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44987",
"datePublished": "2026-05-08T21:59:12.204Z",
"dateReserved": "2026-05-08T16:23:33.265Z",
"dateUpdated": "2026-05-12T18:31:48.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42291 (GCVE-0-2026-42291)
Vulnerability from nvd – Published: 2026-05-08 21:57 – Updated: 2026-05-11 14:27
VLAI
EPSS
VEX
Title
SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional
Summary
SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and creating sharing links for personal notes is not properly authorized. This allows authenticated attackers who obtain the note ID of victim users to list and create sharing links to those users' personal notes. This gives attackers read and write access to notes of other users. This exploit works in both SysReptor Professional and Community. In Community it has, however, no impact because all users have superuser permissions and can list personal notes of other users at /admin/pentests/usernotebookpage/. This issue has been patched in version 2026.27.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 14:27 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
>= 2026.4, < 2026.27
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T14:27:12.975359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T14:27:27.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.4, \u003c 2026.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and creating sharing links for personal notes is not properly authorized. This allows authenticated attackers who obtain the note ID of victim users to list and create sharing links to those users\u0027 personal notes. This gives attackers read and write access to notes of other users. This exploit works in both SysReptor Professional and Community. In Community it has, however, no impact because all users have superuser permissions and can list personal notes of other users at /admin/pentests/usernotebookpage/. This issue has been patched in version 2026.27."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T21:57:51.099Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-pcpr-q2qj-3v43",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-pcpr-q2qj-3v43"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.27"
}
],
"source": {
"advisory": "GHSA-pcpr-q2qj-3v43",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42291",
"datePublished": "2026-05-08T21:57:51.099Z",
"dateReserved": "2026-04-26T12:13:55.551Z",
"dateUpdated": "2026-05-11T14:27:27.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66561 (GCVE-0-2025-66561)
Vulnerability from nvd – Published: 2025-12-04 22:27 – Updated: 2025-12-05 17:28
VLAI
EPSS
VEX
Title
SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS)
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-05 17:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2025.102
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66561",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-05T17:28:31.799698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-05T17:28:41.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2025.102"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-04T22:27:52.015Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-64vw-v5c4-mgvm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-64vw-v5c4-mgvm"
}
],
"source": {
"advisory": "GHSA-64vw-v5c4-mgvm",
"discovery": "UNKNOWN"
},
"title": "SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-66561",
"datePublished": "2025-12-04T22:27:52.015Z",
"dateReserved": "2025-12-04T16:05:22.974Z",
"dateUpdated": "2025-12-05T17:28:41.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59945 (GCVE-0-2025-59945)
Vulnerability from nvd – Published: 2025-09-27 01:01 – Updated: 2025-09-29 14:10
VLAI
EPSS
VEX
Title
SysReptor Susceptible to Privilege Escalation by Authenticated Users
Summary
SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-29 14:10 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/de… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
>= 2024.74, < 2025.83
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59945",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-29T14:10:40.403320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-29T14:10:54.427Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003e= 2024.74, \u003c 2025.83"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266: Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-27T01:01:52.330Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-r6hm-59cq-gjg6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-r6hm-59cq-gjg6"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/de8b5d89d0644479ee0da0a113c6bcc2436ba7f4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/de8b5d89d0644479ee0da0a113c6bcc2436ba7f4"
}
],
"source": {
"advisory": "GHSA-r6hm-59cq-gjg6",
"discovery": "UNKNOWN"
},
"title": "SysReptor Susceptible to Privilege Escalation by Authenticated Users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59945",
"datePublished": "2025-09-27T01:01:52.330Z",
"dateReserved": "2025-09-23T14:33:49.506Z",
"dateUpdated": "2025-09-29T14:10:54.427Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36076 (GCVE-0-2024-36076)
Vulnerability from nvd – Published: 2024-05-19 19:22 – Updated: 2025-02-13 15:59
VLAI
EPSS
VEX
Summary
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 13:39 UTC
CWE
- n/a
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| syslifters | sysreptor |
Affected:
0 , < 2024.40
(custom)
cpe:2.3:a:syslifters:sysreptor:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:syslifters:sysreptor:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "sysreptor",
"vendor": "syslifters",
"versions": [
{
"lessThan": "2024.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-36076",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-20T13:39:34.474066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:48:00.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:30:12.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2024.40"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-2vfc-3h43-vghh"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-21T19:48:27.209Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2024.40"
},
{
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-2vfc-3h43-vghh"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-36076",
"datePublished": "2024-05-19T19:22:49.111Z",
"dateReserved": "2024-05-19T00:00:00.000Z",
"dateUpdated": "2025-02-13T15:59:15.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-81181 (GCVE-0-2026-81181)
Vulnerability from cvelistv5 – Published: 2026-09-18 17:48 – Updated: 2026-09-21 20:48
VLAI
EPSS
VEX
Title
SysReptor: Session Fixation in Password-Protected Shared Notes
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor session cookie, place it in a victim's browser, and know the shared-note URL where the victim authenticates can reuse the fixed session after the victim enters the correct password and access that shared note. The main SysReptor login flow is not affected. This issue is fixed in version 2026.68.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:30 UTC
CWE
- CWE-384 - Session Fixation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/19… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.68
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81181",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:30:39.522705Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:48:45.089Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.68"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor session cookie, place it in a victim\u0027s browser, and know the shared-note URL where the victim authenticates can reuse the fixed session after the victim enters the correct password and access that shared note. The main SysReptor login flow is not affected. This issue is fixed in version 2026.68."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-384",
"description": "CWE-384: Session Fixation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:48:53.253Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wgx3-84xg-q93j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wgx3-84xg-q93j"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/1981717f15afe945aa86d7e0dc9dc30a30c88dea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/1981717f15afe945aa86d7e0dc9dc30a30c88dea"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.68",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.68"
}
],
"source": {
"advisory": "GHSA-wgx3-84xg-q93j",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Session Fixation in Password-Protected Shared Notes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81181",
"datePublished": "2026-09-18T17:48:53.253Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-21T20:48:45.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81182 (GCVE-0-2026-81182)
Vulnerability from cvelistv5 – Published: 2026-09-18 17:48 – Updated: 2026-09-24 21:05
VLAI
EPSS
VEX
Title
SysReptor: Unauthorized file disclosure by broken access control in writable shared notes
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 21:02 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/1b… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/1f… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/f7… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.68
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81182",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T21:02:34.359694Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T21:05:26.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.68"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:48:05.575Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-x3m3-v8pv-442r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-x3m3-v8pv-442r"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/1b721e291ebadfc1457bc8d01f7c70fe5da4b035",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/1b721e291ebadfc1457bc8d01f7c70fe5da4b035"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/1f3fd629c32560fc4280294f8f9bdc44d97c639a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/1f3fd629c32560fc4280294f8f9bdc44d97c639a"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/f730c3acf9ee603f96bb05d598d20f6c4e958eb8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/f730c3acf9ee603f96bb05d598d20f6c4e958eb8"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.68",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.68"
}
],
"source": {
"advisory": "GHSA-x3m3-v8pv-442r",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Unauthorized file disclosure by broken access control in writable shared notes"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81182",
"datePublished": "2026-09-18T17:48:05.575Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-24T21:05:26.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81180 (GCVE-0-2026-81180)
Vulnerability from cvelistv5 – Published: 2026-09-18 17:47 – Updated: 2026-09-22 15:15
VLAI
EPSS
VEX
Title
SysReptor: Authenticated RCE by insecure image processing
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:15 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/7d… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/7e… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/e8… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/f2… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/commit/f5… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.61
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81180",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:15:18.561499Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:15:32.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.61"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory. The injected code executes with the privileges of the SysReptor application process after a worker restart. The Community edition is not affected. Version 2026.58 contains a partial mitigation, and this issue is fully fixed in version 2026.61."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:47:02.134Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wmf3-gv8j-7qp7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-wmf3-gv8j-7qp7"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/7d800e5c737df0dbc3d4ea2d095c89235790a1cc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/7d800e5c737df0dbc3d4ea2d095c89235790a1cc"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/e8bd31cb42a15a10bb5102337b55dde704be397f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/e8bd31cb42a15a10bb5102337b55dde704be397f"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/f27760961943fb1716cbb68f2a6705e7251b4e5c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/f27760961943fb1716cbb68f2a6705e7251b4e5c"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/f5ad35b9e71d370b5e06ef4680979cb05c24ff3c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/f5ad35b9e71d370b5e06ef4680979cb05c24ff3c"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.61",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.61"
}
],
"source": {
"advisory": "GHSA-wmf3-gv8j-7qp7",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Authenticated RCE by insecure image processing"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81180",
"datePublished": "2026-09-18T17:47:02.134Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-22T15:15:32.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81179 (GCVE-0-2026-81179)
Vulnerability from cvelistv5 – Published: 2026-09-18 17:45 – Updated: 2026-09-18 19:49
VLAI
EPSS
VEX
Title
SysReptor: Host header injection might allow account takeover
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim's password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 19:49 UTC
CWE
- CWE-807 - Reliance on Untrusted Inputs in a Security Decision
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/7e… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.58
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81179",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T19:49:37.146667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T19:49:53.040Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.58"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token, allowing the attacker to reset the victim\u0027s password and take over the account. Exploitation also requires a configured email gateway and an email address for the victim, while some reverse proxy configurations may reject the hostile Host header. This issue is fixed in version 2026.58."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-807",
"description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:45:58.249Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-9x2r-5pff-8w6c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-9x2r-5pff-8w6c"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/7ecf56a6b8e5c05a2d2212bc8aa340f69855cdea"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.58",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.58"
}
],
"source": {
"advisory": "GHSA-9x2r-5pff-8w6c",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Host header injection might allow account takeover"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81179",
"datePublished": "2026-09-18T17:45:58.249Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-18T19:49:53.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81178 (GCVE-0-2026-81178)
Vulnerability from cvelistv5 – Published: 2026-09-18 17:44 – Updated: 2026-09-18 18:03
VLAI
EPSS
VEX
Title
SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 18:03 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/1e… | x_refsource_MISC |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.55
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81178",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T18:03:32.395858Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T18:03:40.523Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.55"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and forwards client information, connection, awareness, and deletion events without consistently restricting them to the shared note subtree. The disclosed metadata can identify project members through usernames and names and reveal the identifiers and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access. This issue is fixed in version 2026.55."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T17:44:42.562Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-926c-j47w-8f9c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-926c-j47w-8f9c"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/1e52e5058b0c7f420dc45c87ad72e7a4585477b1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/1e52e5058b0c7f420dc45c87ad72e7a4585477b1"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.55"
}
],
"source": {
"advisory": "GHSA-926c-j47w-8f9c",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Anonymous note-share link discloses project member identities and non-shared note activity"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-81178",
"datePublished": "2026-09-18T17:44:42.562Z",
"dateReserved": "2026-08-26T16:26:08.967Z",
"dateUpdated": "2026-09-18T18:03:40.523Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-44987 (GCVE-0-2026-44987)
Vulnerability from cvelistv5 – Published: 2026-05-08 21:59 – Updated: 2026-05-12 18:31
VLAI
EPSS
VEX
Title
SysReptor: Privilege Escalation from User Admin to Superuser
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If the SysReptor installation has the "Forgot Password" functionality enabled (non-default), they can reset the Superusers' passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves "Project Admin" permissions. This is intentional and by design. This issue has been patched in version 2026.29.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-12 13:00 UTC
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2026.29
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44987",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-12T13:00:12.318338Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-12T18:31:48.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2026.29"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with \"User Admin\" permissions can change the email addresses of users with \"Superuser\" permissions. If the SysReptor installation has the \"Forgot Password\" functionality enabled (non-default), they can reset the Superusers\u0027 passwords and authenticate, if the Superuser has no MFA enabled. User managers can then access the Django backend (/admin) or manipulate the settings of the SysReptor installation. Note that user managers have the ability to access all pentest projects by assigning themselves \"Project Admin\" permissions. This is intentional and by design. This issue has been patched in version 2026.29."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T21:59:12.204Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-6x8f-v3cf-cvr3"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.29",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.29"
}
],
"source": {
"advisory": "GHSA-6x8f-v3cf-cvr3",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Privilege Escalation from User Admin to Superuser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44987",
"datePublished": "2026-05-08T21:59:12.204Z",
"dateReserved": "2026-05-08T16:23:33.265Z",
"dateUpdated": "2026-05-12T18:31:48.576Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42291 (GCVE-0-2026-42291)
Vulnerability from cvelistv5 – Published: 2026-05-08 21:57 – Updated: 2026-05-11 14:27
VLAI
EPSS
VEX
Title
SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional
Summary
SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and creating sharing links for personal notes is not properly authorized. This allows authenticated attackers who obtain the note ID of victim users to list and create sharing links to those users' personal notes. This gives attackers read and write access to notes of other users. This exploit works in both SysReptor Professional and Community. In Community it has, however, no impact because all users have superuser permissions and can list personal notes of other users at /admin/pentests/usernotebookpage/. This issue has been patched in version 2026.27.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-11 14:27 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
>= 2026.4, < 2026.27
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-11T14:27:12.975359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T14:27:27.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003e= 2026.4, \u003c 2026.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. From version 2026.4 to before version 2026.27, the endpoints for reading and creating sharing links for personal notes is not properly authorized. This allows authenticated attackers who obtain the note ID of victim users to list and create sharing links to those users\u0027 personal notes. This gives attackers read and write access to notes of other users. This exploit works in both SysReptor Professional and Community. In Community it has, however, no impact because all users have superuser permissions and can list personal notes of other users at /admin/pentests/usernotebookpage/. This issue has been patched in version 2026.27."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-08T21:57:51.099Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-pcpr-q2qj-3v43",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-pcpr-q2qj-3v43"
},
{
"name": "https://github.com/Syslifters/sysreptor/releases/tag/2026.27",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2026.27"
}
],
"source": {
"advisory": "GHSA-pcpr-q2qj-3v43",
"discovery": "UNKNOWN"
},
"title": "SysReptor: Read-write access to personal notes by sharing-link creation with no authorization in SysReptor Professional"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42291",
"datePublished": "2026-05-08T21:57:51.099Z",
"dateReserved": "2026-04-26T12:13:55.551Z",
"dateUpdated": "2026-05-11T14:27:27.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-66561 (GCVE-0-2025-66561)
Vulnerability from cvelistv5 – Published: 2025-12-04 22:27 – Updated: 2025-12-05 17:28
VLAI
EPSS
VEX
Title
SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS)
Summary
SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-05 17:28 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
< 2025.102
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-66561",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-05T17:28:31.799698Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-05T17:28:41.055Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003c 2025.102"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-04T22:27:52.015Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-64vw-v5c4-mgvm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-64vw-v5c4-mgvm"
}
],
"source": {
"advisory": "GHSA-64vw-v5c4-mgvm",
"discovery": "UNKNOWN"
},
"title": "SysReptor Vulnerable to an Authenticated Stored Cross-Site Scripting (XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-66561",
"datePublished": "2025-12-04T22:27:52.015Z",
"dateReserved": "2025-12-04T16:05:22.974Z",
"dateUpdated": "2025-12-05T17:28:41.055Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-59945 (GCVE-0-2025-59945)
Vulnerability from cvelistv5 – Published: 2025-09-27 01:01 – Updated: 2025-09-29 14:10
VLAI
EPSS
VEX
Title
SysReptor Susceptible to Privilege Escalation by Authenticated Users
Summary
SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83.
Severity
8.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-09-29 14:10 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Syslifters/sysreptor/security/… | x_refsource_CONFIRM |
| https://github.com/Syslifters/sysreptor/commit/de… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Syslifters | sysreptor |
Affected:
>= 2024.74, < 2025.83
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-59945",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-29T14:10:40.403320Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-09-29T14:10:54.427Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sysreptor",
"vendor": "Syslifters",
"versions": [
{
"status": "affected",
"version": "\u003e= 2024.74, \u003c 2025.83"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not members of and are therefore not supposed to access. This issue has been patched in version 2025.83."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266: Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-27T01:01:52.330Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-r6hm-59cq-gjg6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-r6hm-59cq-gjg6"
},
{
"name": "https://github.com/Syslifters/sysreptor/commit/de8b5d89d0644479ee0da0a113c6bcc2436ba7f4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Syslifters/sysreptor/commit/de8b5d89d0644479ee0da0a113c6bcc2436ba7f4"
}
],
"source": {
"advisory": "GHSA-r6hm-59cq-gjg6",
"discovery": "UNKNOWN"
},
"title": "SysReptor Susceptible to Privilege Escalation by Authenticated Users"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-59945",
"datePublished": "2025-09-27T01:01:52.330Z",
"dateReserved": "2025-09-23T14:33:49.506Z",
"dateUpdated": "2025-09-29T14:10:54.427Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36076 (GCVE-0-2024-36076)
Vulnerability from cvelistv5 – Published: 2024-05-19 19:22 – Updated: 2025-02-13 15:59
VLAI
EPSS
VEX
Summary
Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 13:39 UTC
CWE
- n/a
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| syslifters | sysreptor |
Affected:
0 , < 2024.40
(custom)
cpe:2.3:a:syslifters:sysreptor:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:syslifters:sysreptor:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "sysreptor",
"vendor": "syslifters",
"versions": [
{
"lessThan": "2024.40",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-36076",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-20T13:39:34.474066Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:48:00.576Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:30:12.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2024.40"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-2vfc-3h43-vghh"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-21T19:48:27.209Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/Syslifters/sysreptor/releases/tag/2024.40"
},
{
"url": "https://github.com/Syslifters/sysreptor/security/advisories/GHSA-2vfc-3h43-vghh"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-36076",
"datePublished": "2024-05-19T19:22:49.111Z",
"dateReserved": "2024-05-19T00:00:00.000Z",
"dateUpdated": "2025-02-13T15:59:15.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}