kiwitcms Kiwi vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Latest kiwitcms Kiwi vulnerabilities

CVE-2026-49292 — Kiwi TCMS: The /init-db/ page renders and responds to requests after first use (CVSS 0.0)
CVE-2026-55630 — Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase) (CVSS 0.0)
CVE-2026-54724 — Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint (CVSS 6.1)
CVE-2023-36809 — Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox (CVSS 5.4)
CVE-2023-33977 — Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS (CVSS 5.4)
CVE-2023-32686 — kiwitcms vulnerable to stored XSS via unrestricted files upload (CVSS 5.4)
CVE-2023-30628 — Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow (CVSS 8.8)
CVE-2023-30613 — Kiwi TCMS unrestricted file upload vulnerability (CVSS 9.0)
CVE-2023-30544 — Kiwi TCMS may allow user to update email address to unverified one (CVSS 4.3)
CVE-2023-27489 — Stored cross site scripting via SVG file upload in Kiwi TCMS (CVSS 5.4)
CVE-2023-25171 — Kiwi TCMS has denial of service vulnerability on Password reset page (CVSS 5.9)
CVE-2023-25156 — Kiwi TCMS has no protection against brute-force attacks on login page (CVSS 9.8)
CVE-2023-22451 — Weak password requirements in Kiwi TCMS (CVSS 8.8)
CVE-2022-4105 — Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi (CVSS 5.4)