A stored cross-site scripting vulnerability in SysReptor allows authenticated users to execute malicious scripts, potentially leading to unauthorized actions in the context of other users.

This is a stored cross-site scripting (CWE-79) vulnerability where an authenticated user can upload malicious JavaScript files via the web interface. Once uploaded, the script executes in the context of other logged-in users who access the affected content.

Successful exploitation of this vulnerability allows an authenticated attacker to perform actions on behalf of other users, including administrators, which could result in data theft or unauthorized configuration changes. Given the CVSS score of 7.3, this is classified as a high-severity risk that could compromise the integrity and confidentiality of the pentest reporting platform.

Immediate Action: Update the SysReptor platform to version 2025.102 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review application logs for unusual file upload activity or patterns involving non-standard file types that might indicate attempts to inject malicious scripts.

Compensating Controls: Implement strict file type validation and Content Security Policy (CSP) headers at the web server level to restrict the execution of unauthorized scripts and prevent XSS payloads from triggering.

Public Exploit Available: exploit_available (unknown)

Organizations utilizing SysReptor should prioritize upgrading to version 2025.102 immediately to remediate this vulnerability. Given the risk of cross-site scripting in a platform that handles sensitive security reports, ensuring that the software is patched is essential to maintaining the security posture of your reporting infrastructure.