CVE-2025-56527

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage.

• CWE-256

• https://github.com/Cinnamon/kotaemonProduct
• https://github.com/Cinnamon/kotaemon/commit/37cdc28Patch
• https://github.com/HanTul/Kotaemon-CVE-2025-56526-56527-disclosureExploit, Third Party Advisory
• https://harvest-sink-590.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-236770c3fe1e80f6a1aef381fb1c8f73Exploit, Third Party Advisory
• https://skinny-exoplanet-584.notion.site/Stored-XSS-via-Unsanitized-PDF-Content-Rendering-and-Plaintext-Credential-Exposure-in-LocalStorage-22cd1563bd3380458588eb49f361a363?pvs=74Exploit, Third Party Advisory

Published

Nov 18, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-56513NiceHash QuickMiner 6.12.0 perform software updates over HTT…9.8
• CVE-2025-56514Cross Site Scripting (XSS) vulnerability in Fiora chat appli…5.4
• CVE-2025-56515File upload vulnerability in Fiora chat application 1.0.0 th…8.8
• CVE-2025-5652A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-56520Dify v1.6.0 was discovered to contain a Server-Side Request …5.3
• CVE-2025-56526Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 …6.1
• CVE-2025-5653A vulnerability has been found in PHPGurukul Complaint Manag…8.8
• CVE-2025-56534A cross-site scripting (XSS) vulnerability in the custom aut…6.1
• CVE-2025-56535A cross-site scripting (XSS) vulnerability in opennebula v6.…6.1
• CVE-2025-56536A stored cross-site scripting (XSS) vulnerability in openneb…6.1
• CVE-2025-56537A stored cross-site scripting (XSS) vulnerability in openneb…6.1
• CVE-2025-5654A vulnerability was found in PHPGurukul Complaint Management…8.8