Vulnerabilidades de Tryton
CVEs publicadas que afetam produtos de Tryton: 6 registro(s), com severidade, exploração e correções.
CVE-2020-37014
Média · 6.4
CWE-79 30/01/2026
Tryton 5.4 - Persistent Cross-Site Scripting
Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability by inserting script payloads in the name field, which execute in the frontend and backend user interfaces.
CVE-2025-66424
Média · 6.5
CWE-863 30/11/2025
Incorrect Authorization em Tryton Trytond
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
CVE-2025-66423
Alta · 7.1
CWE-863 30/11/2025
Incorrect Authorization em Tryton Trytond
Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
CVE-2025-66422
Média · 4.3
CWE-402 30/11/2025
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back…
Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.
CVE-2025-66421
Média · 5.4
CWE-79 30/11/2025
Cross-site Scripting (XSS) em Tryton Sao
Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69.
CVE-2025-66420
Média · 5.4
CWE-79 30/11/2025
Cross-site Scripting (XSS) em Tryton Sao
Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67.