Description
The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Synchroweb | Kiwire | 3.6 | — |
High · 7.3
CVE-2025-11189
EUVD-2025-33714GHSA-g6jq-5hv4-7vjf
CVE-2025-11189
Published Oct 10, 2025 · Updated Nov 3, 2025 · Assigned by certcc