CVE-2025-70365: n/a
A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages. NOTE: the Supplier's position is that a fix for this had already been released for the 8.3.1 branch before the CVE Record was published.
AI Analysis
Technical Summary
This vulnerability involves stored XSS due to improper output encoding in Kiamo administrative interfaces prior to version 8.4. Authenticated administrative users can inject malicious JavaScript, which executes in other users' browsers when they view affected pages. The supplier indicates that a fix was released in version 8.3.1, which predates the CVE record, implying that versions before 8.3.1 are vulnerable and that 8.3.1 and later are fixed.
Potential Impact
Successful exploitation allows an authenticated administrative user to execute arbitrary JavaScript in the browsers of other users viewing the affected administrative pages. This can lead to information disclosure and integrity impacts within the context of the affected application. The CVSS score is 5.4 (medium severity), reflecting limited scope and privileges required.
Mitigation Recommendations
A fix is available and was released in Kiamo version 8.3.1. Users should upgrade to version 8.3.1 or later to remediate this vulnerability. No additional mitigation steps are indicated by the supplier.
CVE-2025-70365: n/a
Description
A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages. NOTE: the Supplier's position is that a fix for this had already been released for the 8.3.1 branch before the CVE Record was published.
CVSS v3.1
Score 5.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves stored XSS due to improper output encoding in Kiamo administrative interfaces prior to version 8.4. Authenticated administrative users can inject malicious JavaScript, which executes in other users' browsers when they view affected pages. The supplier indicates that a fix was released in version 8.3.1, which predates the CVE record, implying that versions before 8.3.1 are vulnerable and that 8.3.1 and later are fixed.
Potential Impact
Successful exploitation allows an authenticated administrative user to execute arbitrary JavaScript in the browsers of other users viewing the affected administrative pages. This can lead to information disclosure and integrity impacts within the context of the affected application. The CVSS score is 5.4 (medium severity), reflecting limited scope and privileges required.
Mitigation Recommendations
A fix is available and was released in Kiamo version 8.3.1. Users should upgrade to version 8.3.1 or later to remediate this vulnerability. No additional mitigation steps are indicated by the supplier.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-01-09T00:00:00.000Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d7ce5e1cc7ad14dae8f90e
Added to database: 04/09/2026, 16:05:50 UTC
Last enriched: 07/05/2026, 21:43:37 UTC
Last updated: 07/31/2026, 19:22:56 UTC
Views: 95
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.