CVE-2025-2748

Kentico Xperience stored cross-site scripting in multiple-file upload functionality PUBLISHED

Description (CNA)

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.

Affected (CNA)

Vendor / product	Versions
Kentico / Xperience	affected 0 through 13.0.178

CWE

CWE-79, CWE-434

References

https://devnet.kentico.com/download/hotfixes

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.