Skip to content
Kiwitcms Kiwi vulnerabilities
-
kiwitcms kiwi
Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
CVE-2026-55630
0.0 None
-
kiwitcms kiwi
Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint
CVE-2026-54724
6.1 Medium
-
kiwitcms kiwi
Kiwi TCMS: The /init-db/ page renders and responds to requests after first use
CVE-2026-49292
0.0 None
-
kiwitcms kiwi, kiwi tcms +1 more
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
CVE-2023-36809
Fix available
8.1 High
-
kiwitcms kiwi, kiwi tcms +1 more
Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS
CVE-2023-33977
Public exploitFix available
8.1 High
-
kiwitcms kiwi, kiwi tcms +1 more
kiwitcms vulnerable to stored XSS via unrestricted files upload
CVE-2023-32686
Fix available
8.1 High
-
kiwitcms kiwi, kiwi tcms +1 more
Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow
CVE-2023-30628
Fix available
8.8 High
-
kiwitcms kiwi, kiwi tcms +1 more
Kiwi TCMS unrestricted file upload vulnerability
CVE-2023-30613
Fix available
8.1 High
-
kiwitcms kiwi, kiwi tcms +1 more
Kiwi TCMS may allow user to update email address to unverified one
CVE-2023-30544
Fix available
3.9 Low
-
kiwitcms kiwi, kiwi tcms +1 more
Stored cross site scripting via SVG file upload in Kiwi TCMS
CVE-2023-27489
Fix available
7.6 High
-
kiwitcms kiwi, kiwi tcms +1 more
Kiwi TCMS has denial of service vulnerability on Password reset page
CVE-2023-25171
Fix available
7.5 High
-
kiwitcms kiwi, kiwi tcms +1 more
Kiwi TCMS has no protection against brute-force attacks on login page
CVE-2023-25156
Fix available
7.5 High
-
kiwitcms kiwi, kiwi tcms +1 more
Weak password requirements in Kiwi TCMS
CVE-2023-22451
6.5 Medium
-
kiwitcms kiwitcms/kiwi, kiwi tcms +1 more
Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
CVE-2022-4105
Fix available
7.1 High