PT-2025-13652 · Gfi · Gfi Kerioconnect

Published 2025-03-30 · Updated 2025-11-04 · CVE-2025-2976

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GFI KerioConnect version 10.0.6

Description A vulnerability was found in the File Upload component, which can lead to cross-site scripting. The manipulation can be launched remotely. The vendor was contacted about this disclosure but did not respond.

Recommendations For GFI KerioConnect version 10.0.6, consider disabling the File Upload feature until a patch is available to prevent cross-site scripting attacks. Restrict access to the File Upload component to minimize the risk of exploitation.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2025-2976

Affected Products

Gfi Kerioconnect

References · 12

• 🔥 https://github.com/0xs1ash/poc/blob/main/xss.md#2-when-a-file-with-a-malicious-javascript-code-in-its-name-is-uploaded-to-the-system-it-is-displayed-again-on-the-page-within-the-input-field-without-being-sanitized-this-creates-the-potential-for-an-xss-att · Exploit
• https://osv.dev/vulnerability/CVE-2025-2976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2976 · Security Note
• https://t.me/cvenotify/116965 · Telegram Post
• https://t.me/cvetracker/20304 · Telegram Post
• https://t.me/cvedetector/21556 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1906259340970893328 · Twitter Post
• https://twitter.com/CVEnew/status/1906568064608444531 · Twitter Post
• https://t.me/cveNotify/141707 · Telegram Post
• https://vuldb.com/?ctiid.302028 · Note
• https://vuldb.com/?id.302028 · Note
• https://twitter.com/WolfgangSesin/status/1906259321383420382 · Twitter Post