Critical severity · published Nov 19, 2025
CVE-2025-65095
Lookyloo is vulnerable due to improper user input sanitization
9.4
CVSS
0.4%
EPSS
No
On KEV
Description
Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.35.1, there is potential cross-site scripting on index and tree page. This issue has been patched in version 1.35.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
lookyloo · Lookyloo
< 1.35.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65095
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65095
github.com
https://github.com/Lookyloo/lookyloo/blob/main/website/web/default_csp.py
github.com
https://github.com/Lookyloo/lookyloo/commit/ac2f73dbfcad88b815b18c42cca77a1c645f1726
github.com
https://github.com/Lookyloo/lookyloo/security/advisories/GHSA-m9g6-23c8-vrxf
vulnerability.circl.lu
https://vulnerability.circl.lu/vuln/gcve-1-2025-0018
More from lookyloo
9.2
CVE-2026-66824
Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding
6.9
CVE-2026-55835
Lookyloo: Potential sub-system DoS due to parameter missmatch in notification
6.9
CVE-2026-66913
Zip Bomb in Lookyloo Capture Upload Allows Denial of Service
6.1
CVE-2025-66460
Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables
6.1
CVE-2025-66459
Lookyloo vulnerable to XSS due to unescaped error message passed to innerHTML