CVE-2026-65446 in Kali Forms Plugin
Summary
by MITRE • 07/28/2026
Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
Kali Forms version 2.4.18 and earlier contains a critical unauthenticated cross site scripting vulnerability that allows remote attackers to inject malicious scripts into web applications without requiring any authentication credentials. This vulnerability resides within the form processing functionality of the plugin, where user input is not properly sanitized before being rendered back to users. The flaw enables attackers to execute arbitrary JavaScript code in the context of other users' browsers, potentially leading to session hijacking, credential theft, or data manipulation.
The technical implementation of this vulnerability stems from insufficient input validation and output encoding mechanisms within the Kali Forms plugin. When forms are processed and displayed, the application fails to properly escape special characters in user-submitted data before rendering it in HTML contexts. This creates an avenue for attackers to inject malicious script payloads that execute whenever affected pages are viewed by legitimate users. The vulnerability is classified as a classic reflected XSS issue where the malicious payload is embedded in parameters or form fields and executed immediately upon page load.
The operational impact of this vulnerability extends beyond simple script execution, as it can be leveraged for more sophisticated attacks within the context of web application exploitation. An attacker could craft malicious forms that redirect users to phishing sites, steal session cookies, or even inject malware delivery mechanisms. The unauthenticated nature of the exploit means that any user with access to the vulnerable website can potentially exploit this flaw without needing valid credentials, making it particularly dangerous in multi-user environments where different privilege levels exist.
Organizations using Kali Forms versions 2.4.18 or earlier face significant security risks including potential data breaches, unauthorized access to sensitive information, and compromise of user sessions. The vulnerability aligns with CWE-79 which specifically addresses cross site scripting flaws in web applications. From an attacker perspective, this vulnerability maps directly to ATT&CK technique T1566.001 for initial access through malicious web content, and T1071.001 for application layer protocol usage. The exploitability is high due to the lack of authentication requirements and the common nature of form-based applications.
Mitigation strategies should include immediate patching to version 2.4.19 or later which contains the necessary input sanitization fixes. Administrators should also implement additional security measures such as Content Security Policy headers, proper input validation at multiple layers, and regular security audits of web applications. Network-level protections like web application firewalls can provide additional defense in depth. The vulnerability demonstrates the critical importance of proper input sanitization and output encoding practices in preventing XSS attacks. Organizations should conduct thorough penetration testing to identify similar vulnerabilities across their web application portfolio and establish secure coding guidelines that prevent such issues from recurring.