CVE-2025-2748CWE-434CWE-79

Kentico Xperience stored cross-site scripting in multiple-file upload functionality

Medium · published March 24, 2025

Patch now

High probability of exploitation

CVSS calls it medium at 6.1. It sits in the 99.1th percentile for exploit probability.

CVSS v3.1

6.1

EPSS

61%

Percentile

99.1

In the wild

Unconfirmed

What it is

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.

The record

Technical detail

CVSS v3.1: 6.1 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.60586 · 99.1th percentile
Weaknesses: CWE-434 · Unrestricted Upload of File with Dangerous Type; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-03-24T18:22Z

EPSS history

Timeline

24 MAR 18:22Z
Kentico Xperience stored cross-site scripting in multiple-file upload functionality
cvelistv5