https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-66561.htmlhttps://patchthecve.com/cve/CVE-2025-66561.htmlSun, 18 Oct 2026 15:10:00 +0000HIGH 7.3: SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vhttps://patchthecve.com/cve/CVE-2025-59945.htmlhttps://patchthecve.com/cve/CVE-2025-59945.htmlFri, 09 Oct 2026 10:10:00 +0000HIGH 8.1: SysReptor is a fully customizable pentest reporting platform. In versions from 2024.74 to before 2025.83, authenticated and unprivileged (non-admin) users can assign the is_project_admin permission to their own user. This allows users to read, modify and delete pentesting projects they are not membehttps://patchthecve.com/cve/CVE-2024-36076.htmlhttps://patchthecve.com/cve/CVE-2024-36076.htmlWed, 17 Jun 2026 07:36:05 +0000HIGH 8.8: Cross-Site WebSocket Hijacking in SysReptor from version 2024.28 to version 2024.30 causes attackers to escalate privileges and obtain sensitive information when a logged-in SysReptor user visits a malicious same-site subdomain in the same browser session.