high7.3

CVE-2025-11189

The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.

Impact

The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.

Affected products

Vendor	Product	Affected versions
Synchroweb	Kiwire	Version 3.6

Weakness classification

CWE-79

References

NVD record
CVE.org record
https://www.synchroweb.com/release-notes/kiwire/security
https://www.kb.cert.org/vuls/id/887923