CVE-2025-2878

LOW

Kentico CMS < 13.0.178 - Cross-Site Scripting via New Database Parameter in Install Wizard

Title source: llm
STIX 2.1

Description

A vulnerability was found in Kentico CMS up to 13.0.178. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /CMSInstall/install.aspx of the component Additional Database Installation Wizard. The manipulation of the argument new database leads to cross site scripting. The attack can be launched remotely. Upgrading to version 13.0.179 is able to address this issue. It is recommended to upgrade the affected component.

References (4)

Core 4
Core References
Permissions Required, VDB Entry vdb-entry technical-description
https://vuldb.com/?id.301813
Permissions Required, VDB Entry signature permissions-required
https://vuldb.com/?ctiid.301813
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.503058

Scores

CVSS v3 2.4
EPSS 0.0027
EPSS Percentile 19.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79 CWE-94
Status published
Products (1)
Kentico/CMS 13.0.178
Published Mar 27, 2025
Tracked Since Feb 18, 2026