QwikSec

Security Database

CVE

CWE

Training

CVE-2025-66460

Published: Dec 2, 2025

Modified: Dec 2, 2025

PUBLISHED

Description

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, Lookyloo passed improperly escaped values to cells rendered in datatables using the orthogonal-data feature. It is definitely exploitable from the popup view, but it is most probably also exploitable in many other places. This vulnerability is fixed in 1.35.3.

Vendor	Product	Versions
Lookyloo	lookyloo	affected `< 1.35.3`

Weaknesses (CWE)

References

https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-r93r-7jfr-99c3

x_refsource_CONFIRM

https://github.com/Lookyloo/lookyloo/commit/63b39311f6b251a671895d97174345faf1b18e6e

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.