CVE-2026-24751 - Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting · CoreCVE

Back Back to CVE browser

HIGH

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Published Jun 1, 2026

8.2

HIGH

CVSS 3.1

EPSS 0.29%

Description

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Affected products

Vendor Kiteworks Product Secure Data Forms Default
n/a
- Version
  < 9.3.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Secure Data Forms

n/a

Version	Status	Constraints
< 9.3.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (1)

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xp8m-wmmp-f947
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-xp8m-wmmp-f947		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Jun 1, 2026

Updated Jun 2, 2026

Reserved Jan 26, 2026

Link CVE-2026-24751

CISA Vulnrichment

Updated Jun 2, 2026

Status Analyzed

Modified Jul 22, 2026

Link CVE-2026-24751

Severity n/a

Public date n/a

Links CVE-2026-24751