CVE-2025-2748 - CVE House

Status published Medium CVE-2025-2748

Kentico Xperience stored cross-site scripting in multiple-file upload functionality

6.1 CVSS

Vulnerability Description

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2748

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Piotr Bazydlo (watchTowr)

References

https://devnet.kentico.com/download/hotfixes

More from Kentico

View All →

CVE-2025-5591

Stored Cross-site Scripting (XSS) in Kentico Xperience 13

High 7.7

CVE-2025-32370

Kentico Xperience before 13.0.178 has a specific set of allowed...

High 7.2

CVE-2025-32369

Kentico Xperience before 13.0.181 allows authenticated users to distribute malicious...

Medium 6.4

CVE-2025-2878

Kentico CMS Additional Database Installation Wizard install.aspx cross site scripting

Medium 4.8

CVE-2025-2794

Kentico Xperience <= 13.0.180 Unsafe Reflection

High 8.7

Affected Vendor

Kentico

View all reports →

Affected Software

Xperience

Vulnerable Versions:

Timeline

Official Publish: March 24th, 2025

Last Modified: December 27th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79 CWE-434

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

Initial Access

T1059.007 JavaScript

Execution

T1539 Steal Web Session Cookie

Collection

T1213 Data from Information Repositories

Collection

T1567 Exfiltration Over Web Service

Exfiltration

T1491.001 Defacement

Impact

T1190 Exploit Public-Facing Application

Initial Access

T1505.003 Web Shell

Persistence

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter