CVE-2026-24751 — Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

CVE-2026-24751

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting PUBLISHED

Description (CNA)

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Affected (CNA)

Vendor / product	Versions
kiteworks / Secure Data Forms	affected < 9.3.0

CWE

CWE-79

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xp8m-wmmp-f947

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.