CVE-2025-11189

HighCVSS 7.3

Published: 10/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

30th percentile - higher than 30% of all known CVEs

Summary

Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability in the login-url parameter, allowing JavaScript execution.

Risk Assessment

Risk of malicious script execution in the user's browser, potentially leading to session theft or other attacks.

Recommendation

Apply the vendor's patch or update the software. Sanitize input in the login-url parameter.

Other vulnerabilities in Kiwire Captive Portal

See all

CVE-2025-11190Medium
The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.
CVE-2025-11188High
Kiwire Captive Portal contains a blind SQL injection vulnerability in the nas-id parameter, allowing SQL commands to be issued and compromising the corresponding database.

Original NVD description (English source)

The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS