Synchroweb Kiwire vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Synchroweb Kiwire: 3 record(s), with affected versions and fixes.
cpe:2.3:a:synchroweb:kiwire

CVE-2025-11190 Medium · 5.4 CWE-59 Oct 10, 2025

The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.

CVE-2025-11189 High · 7.3 CWE-79 Oct 10, 2025

The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.

CVE-2025-11188 High · 7.3 CWE-89 Oct 10, 2025

The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding database.