Tryton vulnerabilities
Published CVEs affecting Tryton products: 6 record(s), with severity, exploitation and fixes.
CVE-2020-37014
Medium · 6.4
CWE-79 Jan 30, 2026
Tryton 5.4 - Persistent Cross-Site Scripting
Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability by inserting script payloads in the name field, which execute in the frontend and backend user interfaces.
CVE-2025-66424
Medium · 6.5
CWE-863 Nov 30, 2025
Incorrect Authorization in Tryton Trytond
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
CVE-2025-66423
High · 7.1
CWE-863 Nov 30, 2025
Incorrect Authorization in Tryton Trytond
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
CVE-2025-66422
Medium · 4.3
CWE-402 Nov 30, 2025
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back…
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
CVE-2025-66421
Medium · 5.4
CWE-79 Nov 30, 2025
Cross-site Scripting (XSS) in Tryton Sao
Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.
CVE-2025-66420
Medium · 5.4
CWE-79 Nov 30, 2025
Cross-site Scripting (XSS) in Tryton Sao
Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.