CVE-2025-25018CWE-79cross-site-scripting

CVE-2025-25018

High · published October 10, 2025

CVSS v3.1
8.7
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting (XSS)

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00229 · 13.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-10-10T14:15Z
Affected products (4)
ProductVersionsFixed in
elastic/kibana≥ 7.0.0, < 8.18.88.18.8
elastic/kibana≥ 8.19.0, < 8.19.58.19.5
elastic/kibana≥ 9.0.0, < 9.0.89.0.8
elastic/kibana≥ 9.1.0, < 9.1.59.1.5
References (1)
https://https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-9-1-5-security-update-esa-2025-17/382451 · [email protected]
EPSS history
Timeline
  • 10 OCT 09:50Z
    Kibana Stored Cross-Site Scripting (XSS)
    cvelistv5