CVE-2025-70365
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability exists in Kiamo before version 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages.
Risk Assessment
The risk involves potential session hijacking, data theft, or unauthorized actions in the context of other users, including administrators. However, the attack requires an authenticated administrative account.
Recommendation
Immediately upgrade Kiamo to version 8.4 or later. If using the 8.3.1 branch, apply the available patch.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages. NOTE: the Supplier's position is that a fix for this had already been released for the 8.3.1 branch before the CVE Record was published.