CVE-2025-2748 PoC — Kentico Xperience 安全漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2748.yaml

Associated Vulnerability

Title:Kentico Xperience 安全漏洞 (CVE-2025-2748)
Description:Kentico Xperience是Kentico公司的一个数字体验平台。 Kentico Xperience 13.0.178及之前版本存在安全漏洞，该漏洞源于容易受到存储型跨站脚本攻击。

Description

The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.

File Snapshot


 id: CVE-2025-2748

info:
  name: Kentico Xperience CMS - Unauthenticated Stored XSS
  author: iamnoo

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!