CVE-2025-70365
Medium
Description
A stored cross-site scripting (XSS) vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages. NOTE: the Supplier's position is that a fix for this had already been released for the 8.3.1 branch before the CVE Record was published.
SeverityMedium
CVSS5.4
Exploit probability—
ProductKiamo
PublishedApr 9, 2026
First seenApr 9, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- Kiamo Kiamo8.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Kiamo Kiamo | No range specified | 8.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.