VendorsKiwitcmskiwi_tcmsany version
Vulnerabilities

Kiwitcms Kiwi Tcms any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

11CVEs
CVE-2023-25156
Kiwi TCMS has no protection against brute-force attacks on login page
Published 2023-02-15 · Modified
9.8EPSS 0.009
CVE-2023-30613
Kiwi TCMS unrestricted file upload vulnerability
Published 2023-04-24 · Analyzed
9.0EPSS 0.010
CVE-2023-30628
Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow
Published 2023-04-24 · Modified
8.8EPSS 0.036
CVE-2023-22451
Weak password requirements in Kiwi TCMS
Published 2023-01-02 · Modified
8.8EPSS 0.007
CVE-2023-33977
Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS
Published 2023-06-06 · Modified
8.1EPSS 0.009
CVE-2023-36809
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
Published 2023-07-05 · Modified
8.1EPSS 0.007
CVE-2023-32686
kiwitcms vulnerable to stored XSS via unrestricted files upload
Published 2023-05-27 · Modified
8.1EPSS 0.004
CVE-2023-27489
Stored cross site scripting via SVG file upload in Kiwi TCMS
Published 2023-03-29 · Modified
7.6EPSS 0.005
CVE-2023-25171
Kiwi TCMS has denial of service vulnerability on Password reset page
Published 2023-02-15 · Modified
7.5EPSS 0.009
CVE-2022-4105
Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
Published 2022-11-21 · Modified
7.1EPSS 0.005
CVE-2023-30544
Kiwi TCMS may allow user to update email address to unverified one
Published 2023-04-24 · Modified
4.3EPSS 0.004