A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 30 Sep 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted content that later executes arbitrary JavaScript in the authenticated session of an administrator who views the affected page. This could have permitted the attacker to gain full administrative control, including the creation of a new administrative account. | |
| Title | Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS) | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: cisa-cg
Published:
Updated: 2026-09-30T20:09:08.315Z
Reserved: 2026-09-28T17:39:13.564Z
Link: CVE-2026-102147
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-30T21:17:03.633
Modified: 2026-09-30T21:17:03.633
Link: CVE-2026-102147
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses