# CVE-2025-66459: Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.

Source: https://junglewise.ai/threats/cve-2025-66459-lookyloo-is-a-web-interface-that-allows-users-to-capture-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-02  
License: CC BY 4.0 with a link back

CVE-2025-66459 · Severity: medium · CVSS 6.1 · Published 2025-12-02

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.35.3, a XSS vulnerability can be triggered when a user submits a list of URLs to capture, one of them contains a HTML element, and the capture fails. Then, the error field is populated with an error message that contains the bad URL they tried to capture, triggering the XSS. This vulnerability is fixed in 1.35.3.

Technologies: [Lookyloo](https://junglewise.ai/threats/technologies/lookyloo). Vendors: [Lookyloo](https://junglewise.ai/threats/vendors/lookyloo).

## Quick answers

**Is CVE-2025-66459 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66459 being exploited in the wild.

**How severe is CVE-2025-66459?** Medium severity, with a CVSS score of 6.1, published 2 December 2025.

**Which products and versions are affected?** Lookyloo. The advisory does not name versions.

**Is there a fix for CVE-2025-66459?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-66459?** Check whether you run Lookyloo. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Lookyloo

## Related threats

- [Lookyloo parameter injection in report API endpoint](https://junglewise.ai/threats/cve-2026-55835-lookyloo-is-a-web-interface-that-allows-users-to-capture-a)
- [Lookyloo denial of service via zip bomb in capture imports](https://junglewise.ai/threats/cve-2026-66913-lookyloo-denial-of-service-via-zip-bomb-in-capture-imports)
- [Lookyloo stored XSS in capture tree visualization page](https://junglewise.ai/threats/cve-2026-66824-lookyloo-stored-xss-in-capture-tree-visualization-page)
- [Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.](https://junglewise.ai/threats/cve-2025-66460-lookyloo-is-a-web-interface-that-allows-users-to-capture-a)
- [Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.](https://junglewise.ai/threats/cve-2025-66458-lookyloo-is-a-web-interface-that-allows-users-to-capture-a)