CVE-2025-2748

Published Mar 24, 2025

Last updated 8 days ago

CVSS medium 6.5

Overview

Description
The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.
Source
disclosure@vulncheck.com
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
6.5
Impact score
3.6
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Severity
MEDIUM

Weaknesses

disclosure@vulncheck.com
CWE-79

Social media

Hype score
Not currently trending

  1. 🚨 CVE-2025-2748 - medium 🚨 Kentico Xperience CMS - Unauthenticated Stored XSS > The Kentico Xperience application does not fully validate or filter files uploaded vi... 👾 https://t.co/ZEgWCg55ZA @pdnuclei #NucleiTemplates #cve

    @pdnuclei_bot

    1 Apr 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

References