Kiteworks Secure Data Forms vulnerable to Cross-site Scripting_CVE-2026-24750

7.6 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Description

Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

Basic Information

ID CVE-2026-24750

Source GitHub_M

Published Mar 25, 2026 at 15:22

Modified Mar 26, 2026 at 19:52

Affected Product

Vendor kiteworks

Product Secure Data Forms

Version < 9.2.1

Affected Versions kiteworks Secure Data Forms < 9.2.1

CWE Classification

CWE-79

References

github.com /kiteworks/security-advisories/security/advisories/GHSA-rfwm-2hq6-h84g

{
    "lastseen": "",
    "description": "Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.",
    "published": "2026-03-25T15:22:16.694Z",
    "modified": "2026-03-26T19:52:12.631Z",
    "type": "cve",
    "title": "Kiteworks Secure Data Forms vulnerable to Cross-site Scripting",
    "source": "GitHub_M",
    "references": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-rfwm-2hq6-h84g",
    "id": "CVE-2026-24750",
    "bulletinFamily": "",
    "cwe": [
        "CWE-79"
    ],
    "cvelist": null,
    "sourceData": "kiteworks Secure Data Forms < 9.2.1",
    "sourceHref": "",
    "cvss": {
        "score": 7.6,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Secure Data Forms",
    "version": "< 9.2.1",
    "vendor": "kiteworks",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}