What is the CVSS score of CVE-2025-70365?

CVE-2025-70365 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

N A CVE-2025-70365

EUVD-2025-209388 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-09 mitre

XSS N A

5.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 09, 2026 - 16:00 euvd

EUVD-2025-209388

Analysis Generated

Apr 09, 2026 - 16:00 vuln.today

CVE Published

Apr 09, 2026 - 00:00 nvd

MEDIUM 5.4

DescriptionCVE.org

A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages.

AnalysisAI

Stored cross-site scripting in Kiamo before version 8.4 allows authenticated administrative users to inject persistent JavaScript payloads into administrative interfaces due to improper output encoding, resulting in execution within browsers of subsequent users accessing affected pages. The vulnerability requires valid admin credentials and user interaction (clicking a link or viewing a page) to trigger payload execution, making it a targeted attack vector against administrative personnel. EPSS probability is extremely low at 0.02%, and no active exploitation has been confirmed, though the issue affects a web-based application platform.

Technical ContextAI

This vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application flaw where untrusted user input is not properly sanitized or HTML-encoded before being stored in a database and subsequently rendered in HTML responses. The Kiamo administrative interface fails to apply contextual output encoding when displaying user-controlled data, allowing attackers to break out of the intended data context and inject executable script tags or event handlers. This is a stored (persistent) XSS variant, meaning the malicious payload remains in the application's data store and affects all users who view the compromised page, rather than requiring the attacker to craft a malicious URL for each victim.

RemediationAI

Upgrade Kiamo to version 8.4 or later, which includes proper output encoding in administrative interface components. Organizations using Kiamo should prioritize this patch during standard maintenance windows. As an interim mitigation if immediate patching is not possible, restrict administrative interface access to trusted IP ranges and ensure strong authentication controls for admin accounts are in place. The GitHub advisory at https://github.com/hackvens/blog.hackvens.fr/blob/main/_posts/advisories/2025-12-23-CVE-2025-70365-Kiamo.md and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-70365 provide additional technical detail.