kiwitcms vulnerabilities
CVEs whose affected-version data names the kiwitcms package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
9 CVEsRSS
CVE-2023-36809High· 8.1Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
▾ Twilightkiwitcms · kiwitcmsEPSS 0.69%via OSV
CVE-2023-33977High· 8.1PoCkiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
▾ Midnightkiwitcms · kiwitcmsEPSS 0.87%via OSV
CVE-2023-32686Medium· 5.4kiwitcms vulnerable to stored XSS via unrestricted files upload
kiwitcms vulnerable to stored XSS via unrestricted files upload
▾ Sunlitkiwitcms · kiwitcmsEPSS 0.43%via OSV
CVE-2023-30613High· 7.7Unrestricted file upload in kiwi TCMS
Unrestricted file upload in kiwi TCMS
▾ Twilightkiwitcms · kiwitcmsEPSS 1.0%via OSV
CVE-2023-30544None· 0.0kiwi TCMS has possibility for user to update email address to unverified one
kiwi TCMS has possibility for user to update email address to unverified one
▾ Sunlitkiwitcms · kiwitcmsEPSS 0.42%via OSV
CVE-2023-27489High· 7.6Kiwi TCMS Stored Cross-site Scripting via SVG file
Kiwi TCMS Stored Cross-site Scripting via SVG file
▾ Twilightkiwitcms · kiwitcmsEPSS 0.48%via OSV
CVE-2023-25171High· 7.5Denial of service vulnerability on Password reset page
Denial of service vulnerability on Password reset page
▾ Twilightkiwitcms · kiwitcmsEPSS 0.92%via OSV
CVE-2023-25156High· 7.5No protection against brute-force attacks on login page
No protection against brute-force attacks on login page
▾ Twilightkiwitcms · kiwitcmsEPSS 0.91%via OSV
CVE-2022-4105Medium· 5.4Cross-site Scripting in kiwitcms
Cross-site Scripting in kiwitcms
▾ Sunlitkiwitcms · kiwitcmsEPSS 0.49%via OSV