CVE-2025-2976mediumCWE-79CWE-94

CVE-2025-2976: fallo de gravedad media en GFI KerioConnect

GFI KerioConnect File Upload cross site scripting

Publicada el

Seguir esta CVE+ Monitorear KerioConnect

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1epss 0.3%
A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the component File Upload. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
GFI · KerioConnect
CVEs relacionadas — GFI KerioConnect

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-2977MEDIUMGFI KerioConnect PDF File cross site scriptingEPSS 0.3%CVE-2025-2975MEDIUMGFI KerioConnect Signature EditHtmlSource cross site scriptingEPSS 0.3%