kiwitcms records

11 published records for vendor kiwitcms.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 90.9%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

11 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2023-25156No exploit	Kiwi TCMS has no protection against brute-force attacks on login pagekiwitcms · kiwi tcms · CWE-770 Pre-auth Denial of service	Critical9.8	—	0.9%	Feb 15, 2023
36Monitor	CVE-2023-30628No exploit	Kiwi TCMS has command injection vulnerability in changelog.yml CI workflowkiwitcms · kiwi tcms · CWE-78 RCE Command injection	High8.8	—	3.6%	Apr 24, 2023
36Monitor	CVE-2023-30613No exploit	Kiwi TCMS unrestricted file upload vulnerabilitykiwitcms · kiwi tcms · CWE-434 File upload XSS	Critical9.0	—	1.0%	Apr 24, 2023
35Monitor	CVE-2023-22451No exploit	Weak password requirements in Kiwi TCMSkiwitcms · kiwi tcms · CWE-521 Pre-auth	High8.8	—	0.7%	Jan 2, 2023
23Monitor	CVE-2023-25171No exploit	Kiwi TCMS has denial of service vulnerability on Password reset pagekiwitcms · kiwi tcms · CWE-770 Pre-auth Denial of service	Medium5.9	—	0.9%	Feb 15, 2023
21Monitor	CVE-2023-33977Proof of concept	Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMSkiwitcms · kiwi tcms · CWE-79 File upload XSS	Medium5.4	—	0.9%	Jun 6, 2023
21Monitor	CVE-2023-36809No exploit	Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefoxkiwitcms · kiwi tcms · CWE-79 XSS	Medium5.4	—	0.7%	Jul 5, 2023
21Monitor	CVE-2022-4105No exploit	Cross-site Scripting (XSS) - Stored in kiwitcms/kiwikiwitcms · kiwi tcms · CWE-79 XSS	Medium5.4	—	0.5%	Nov 21, 2022
21Monitor	CVE-2023-27489No exploit	Stored cross site scripting via SVG file upload in Kiwi TCMSkiwitcms · kiwi tcms · CWE-79 XSS	Medium5.4	—	0.5%	Mar 29, 2023
21Monitor	CVE-2023-32686No exploit	kiwitcms vulnerable to stored XSS via unrestricted files uploadkiwitcms · kiwi tcms · CWE-79 XSS	Medium5.4	—	0.4%	May 27, 2023
17Monitor	CVE-2023-30544No exploit	Kiwi TCMS may allow user to update email address to unverified onekiwitcms · kiwi tcms · CWE-283	Medium4.3	—	0.4%	Apr 24, 2023

CVE-2023-25156
39Monitor
Kiwi TCMS has no protection against brute-force attacks on login page
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Denial of service
kiwitcms · kiwi tcmsFeb 15, 2023
CVE-2023-30628
36Monitor
Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow
HighCVSS 8.8No exploitEPSS 4%
- RCE
- Command injection
kiwitcms · kiwi tcmsApr 24, 2023
CVE-2023-30613
36Monitor
Kiwi TCMS unrestricted file upload vulnerability
CriticalCVSS 9.0No exploitEPSS 1%
- File upload
- XSS
kiwitcms · kiwi tcmsApr 24, 2023
CVE-2023-22451
35Monitor
Weak password requirements in Kiwi TCMS
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
kiwitcms · kiwi tcmsJan 2, 2023
CVE-2023-25171
23Monitor
Kiwi TCMS has denial of service vulnerability on Password reset page
MediumCVSS 5.9No exploitEPSS 1%
- Pre-auth
- Denial of service
kiwitcms · kiwi tcmsFeb 15, 2023
CVE-2023-33977
21Monitor
Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS
MediumCVSS 5.4Proof of conceptEPSS 1%
- File upload
- XSS
kiwitcms · kiwi tcmsJun 6, 2023
CVE-2023-36809
21Monitor
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
MediumCVSS 5.4No exploitEPSS 1%
- XSS
kiwitcms · kiwi tcmsJul 5, 2023
CVE-2022-4105
21Monitor
Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
MediumCVSS 5.4No exploitEPSS 0%
- XSS
kiwitcms · kiwi tcmsNov 21, 2022
CVE-2023-27489
21Monitor
Stored cross site scripting via SVG file upload in Kiwi TCMS
MediumCVSS 5.4No exploitEPSS 0%
- XSS
kiwitcms · kiwi tcmsMar 29, 2023
CVE-2023-32686
21Monitor
kiwitcms vulnerable to stored XSS via unrestricted files upload
MediumCVSS 5.4No exploitEPSS 0%
- XSS
kiwitcms · kiwi tcmsMay 27, 2023
CVE-2023-30544
17Monitor
Kiwi TCMS may allow user to update email address to unverified one
MediumCVSS 4.3No exploitEPSS 0%
kiwitcms · kiwi tcmsApr 24, 2023