PT-2026-31638 · Kiamo · Kiamo

Published 2026-04-09 · Updated 2026-04-09 · CVE-2025-70365

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Kiamo versions prior to 8.4

Description A stored cross-site scripting (XSS) issue exists due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages.

Recommendations Update to version 8.4 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-70365

Affected Products

Kiamo

References · 6

• 🔥 https://github.com/hackvens/blog.hackvens.fr/blob/main/_posts/advisories/2025-12-23-CVE-2025-70365-Kiamo.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70365 · Security Note
• https://twitter.com/CVEnew/status/2042302843437400533 · Twitter Post
• https://twitter.com/infoflowcloud/status/2042304404531900650 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2042316017485947254 · Twitter Post
• http://kiamo.com · Note