CVE-2026-24750: high-severity vulnerability in kiteworks Secure Data Forms
Kiteworks Secure Data Forms vulnerable to Cross-site Scripting
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6epss 0.2%
Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Affected products
kiteworks · Secure Data FormsRelated CVEs — kiteworks Secure Data Forms
In the same product, most dangerous first.
CVE-2026-23636MEDIUMKiteworks Secure Data Forms is vulnerable to an Unrestricted Upload of File with Dangerous TypeEPSS 1.0%CVE-2026-24782HIGHKiteworks Secure Data Forms has a SQL Injection vulnerabilityEPSS 0.7%CVE-2026-23635MEDIUMKiteworks Secure Data Forms has a potential Unprotected Transport of CredentialsEPSS 0.3%CVE-2026-24751HIGHKiteworks Secure Data Forms Vulnerable to Cross-site ScriptingEPSS 0.3%CVE-2026-24752HIGHKiteworks Secure Data Forms Vulnerable to Cross-site ScriptingEPSS 0.3%CVE-2026-23638MEDIUMKiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled KeyEPSS 0.2%