CVE-2025-66421

6th percentile - higher than 6% of all known CVEs

Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.

The risk includes the possibility of executing malicious scripts in the user's browser, which could lead to data theft or session hijacking. This may compromise the security of the application and organizational data.

It is recommended to upgrade tryton-sao to one of the patched versions. Also, check if the vulnerability has been exploited in the production environment.