{"id":"CVE-2025-2748","aliases":["EUVD-2025-8011","GHSA-fx68-23vp-xpxr"],"status":"published","title":"Kentico Xperience stored cross-site scripting in multiple-file upload functionality","description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.60586,"percentile":0.99151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434","CWE-79"],"published":"2025-03-24T18:22:30Z","modified":"2026-06-17T09:07:33Z","exploits":[{"source":"nuclei","id":"CVE-2025-2748","title":"Kentico Xperience CMS - Unauthenticated Stored XSS","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2748.yaml"},{"source":"pocgithub","id":"xirtam2669/Kentico-Xperience-before-13.0.178---XSS-POC","title":"xirtam2669/Kentico-Xperience-before-13.0.178---XSS-POC","date":"2025-05-09","url":"https://github.com/xirtam2669/Kentico-Xperience-before-13.0.178---XSS-POC"}],"products":[{"vendor":"kentico","product":"xperience"}],"references":[{"url":"https://devnet.kentico.com/download/hotfixes","tags":["vendor-advisory","patch","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2748"},{"url":"https://github.com/advisories/GHSA-fx68-23vp-xpxr"}],"sources":{"cve":[{"id":"CVE-2025-2748","title":"Kentico Xperience stored cross-site scripting in multiple-file upload functionality","description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.","status":"published","published":"2025-03-24T18:22:30.734Z","modified":"2025-12-27T16:47:39.767Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79","CWE-434"],"updated_at":"2026-11-02T14:32:39.039362Z"}],"euvd":[{"id":"EUVD-2025-8011","description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.","status":"published","published":"2025-03-24T18:22:30Z","modified":"2025-12-27T16:47:39Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:00.939401Z"}],"ghsa":[{"id":"GHSA-fx68-23vp-xpxr","title":"The Kentico Xperience application does not fully validate or filter files uploaded via the...","description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.","status":"published","published":"2025-03-24T21:30:33Z","modified":"2025-03-24T21:30:39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:00:25.909155Z"}],"nvd":[{"id":"CVE-2025-2748","description":"The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.","status":"published","published":"2025-03-24T19:15:52.27Z","modified":"2026-06-17T09:07:33.32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79","CWE-434"],"updated_at":"2026-11-02T14:10:55.858901Z"}]}}