EUVD-2025-209388CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages.
Analysis
Stored cross-site scripting in Kiamo before version 8.4 allows authenticated administrative users to inject persistent JavaScript payloads into administrative interfaces due to improper output encoding, resulting in execution within browsers of subsequent users accessing affected pages. The vulnerability requires valid admin credentials and user interaction (clicking a link or viewing a page) to trigger payload execution, making it a targeted attack vector against administrative personnel. EPSS probability is extremely low at 0.02%, and no active exploitation has been confirmed, though the issue affects a web-based application platform.
Technical Context
This vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application flaw where untrusted user input is not properly sanitized or HTML-encoded before being stored in a database and subsequently rendered in HTML responses. The Kiamo administrative interface fails to apply contextual output encoding when displaying user-controlled data, allowing attackers to break out of the intended data context and inject executable script tags or event handlers. This is a stored (persistent) XSS variant, meaning the malicious payload remains in the application's data store and affects all users who view the compromised page, rather than requiring the attacker to craft a malicious URL for each victim.
Affected Products
Kiamo versions prior to 8.4 are affected. The CVE entry references the official Kiamo website (kiamo.com) as the vendor, and the vulnerability exists in the administrative interface component of the application. While specific major version ranges are not detailed in the provided references, the advisory indicates that upgrading to version 8.4 or later resolves the issue. Exact CPE coverage is not clearly defined in the provided data, limiting granular inventory matching.
Remediation
Upgrade Kiamo to version 8.4 or later, which includes proper output encoding in administrative interface components. Organizations using Kiamo should prioritize this patch during standard maintenance windows. As an interim mitigation if immediate patching is not possible, restrict administrative interface access to trusted IP ranges and ensure strong authentication controls for admin accounts are in place. The GitHub advisory at https://github.com/hackvens/blog.hackvens.fr/blob/main/_posts/advisories/2025-12-23-CVE-2025-70365-Kiamo.md and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-70365 provide additional technical detail.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today