getkirby/cms vulnerabilities (Packagist)
51 vulnerabilities.
-
getkirby/cmsPackagist Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling 8.2 High -
getkirby/cmsPackagist Kirby: Access to image files outside of the site root via path traversal in the media handling 6.9 Medium -
getkirby/cmsPackagist Kirby: File upload permissions are not checked during processing of chunk data 7.1 High -
getkirby/cmsPackagist Kirby: System path exposure from error messages in the REST API 6.9 Medium -
getkirby/cmsPackagist Kirby: `pages.access` permission is not checked in the `site/find` REST API route 7.1 High -
getkirby/cmsPackagist Kirby: Access to files of top-level drafts is not protected by permissions 6.3 Medium -
getkirby/cmsPackagist Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header 9.1 Critical -
getkirby/cmsPackagist Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` 8.5 High -
getkirby/cmsPackagist Kirby: Request header injection in `Http\Remote` 6.9 Medium -
getkirby/cmsPackagist Kirby: Self cross-site scripting (self-XSS) in the writer field 7.4 High -
getkirby/cmsPackagist Kirby: `pages.access` permission is not checked in the pages picker for parent pages 5.3 Medium -
getkirby/cmsPackagist Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend 8.4 High -
getkirby/cmsPackagist Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions 5.3 Medium -
getkirby/cmsPackagist Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup 8.8 High -
getkirby/cmsPackagist Kirby: `pages.access` permission is not checked during rendering of page drafts 6.0 Medium -
getkirby/cmsPackagist Kirby: Cross-site scripting (XSS) from list field content in the site frontend 8.5 High -
getkirby/cmsPackagist Kirby: Arbitrary Method Call via REST API search and collection query endpoints 8.7 High -
getkirby/cmsPackagist Kirby: System API endpoint leaks license data and installed version to authenticated users 5.3 Medium -
getkirby/cmsPackagist Kirby: User avatar creation, replacement and deletion are not gated by user update permissions 5.3 Medium -
getkirby/cmsPackagist Kirby: Read access to site, user and role information is not gated by permissions 7.1 High -
getkirby/cmsPackagist Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog 7.1 High -
getkirby/cmsPackagist Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection 7.1 High -
getkirby/cmsPackagist Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter 5.3 Medium -
getkirby/cmsPackagist Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering 7.6 High -
getkirby/cmsPackagist Kirby has XML injection in its XML creator toolkit 6.9 Medium -
getkirby/cmsPackagist Kirby is missing permission checks in the content changes API 5.8 Medium -
getkirby/cmsPackagist Kirby CMS has cross-site scripting (XSS) in the changes dialog 5.1 Medium -
getkirby/cmsPackagist Path traversal of collection names during file system lookup 6.3 Medium -
getkirby/cmsPackagist Kirby vulnerable to path traversal in the router for PHP's built-in server 2.3 Low -
getkirby/cmsPackagist Insufficient permission checks in the language settings in Kirby CMS 8.1 High -
getkirby/cmsPackagist Kirby cross-site scripting (XSS) in the link field "Custom" type 4.6 Medium -
getkirby/cmsPackagist Kirby vulnerable to unrestricted file upload of user avatar images 8.8 High -
getkirby/cmsPackagist Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field 4.7 Medium -
getkirby/cmsPackagist Kirby vulnerable to denial of service from unlimited password lengths 5.3 Medium -
getkirby/cmsPackagist Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files 5.7 Medium -
getkirby/cmsPackagist Kirby XML External Entity (XXE) vulnerability in the XML data handler 6.8 Medium -
getkirby/cmsPackagist Kirby vulnerable to Insufficient Session Expiration after a password change 7.3 High -
getkirby/cmsPackagist Kirby vulnerable to field injection in the KirbyData text storage handler 7.1 High -
getkirby/cmsPackagist Kirby CMS vulnerable to user enumeration in the brute force protection 6.5 Medium -
getkirby/cmsPackagist User enumeration in the code-based login and password reset forms 4.8 Medium -
getkirby/cmsPackagist Cross-site scripting from content entered in the tags and multiselect fields 7.1 High -
getkirby/cmsPackagist Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby 5.9 Medium -
getkirby/cmsPackagist Kirby CMS 2.5.12 Cross-site Request Forgery 4.3 Medium -
getkirby/cmsPackagist Kirby CMS 2.5.12 Cross-site Scripting 5.4 Medium -
getkirby/cmsPackagist Cross-site scripting (XSS) from image block content in the site frontend 7.3 High -
getkirby/cmsPackagist Cross-site scripting (XSS) from writer field content in the site frontend 7.3 High -
getkirby/cmsPackagist Cross-site scripting (XSS) from field and configuration text displayed in the Panel 7.1 High -
getkirby/cmsPackagist Cross-site scripting (XSS) from unsanitized uploaded SVG files 7.6 High -
getkirby/cmsPackagist PHP Phar archives could be uploaded and executed in Kirby 6.8 Medium -
getkirby/cmsPackagist .dev domains treated as local in Kirby 6.8 Medium - Show olderLoading…