kiwitcms vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 202310
3. 20263

Newest CVEs

• CVE-2026-49292

  Kiwi TCMS: The /init-db/ page renders and responds to requests after first use

  kiwitcms · Kiwi

  None0.0
• CVE-2026-55630

  Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)

  kiwitcms · Kiwi

  None0.0
• CVE-2026-54724

  Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint

  kiwitcms · Kiwi

  Medium6.1
• CVE-2023-36809

  Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox

  kiwitcms · Kiwi

  High8.1
• CVE-2023-33977

  Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS

  kiwitcms · Kiwi

  High8.1
• CVE-2023-32686

  kiwitcms vulnerable to stored XSS via unrestricted files upload

  kiwitcms · Kiwi

  High8.1
• CVE-2023-30628

  Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow

  kiwitcms · Kiwi

  High8.8
• CVE-2023-30613

  Kiwi TCMS unrestricted file upload vulnerability

  kiwitcms · Kiwi

  High8.1
• CVE-2023-30544

  Kiwi TCMS may allow user to update email address to unverified one

  kiwitcms · Kiwi

  Low3.9
• CVE-2023-27489

  Stored cross site scripting via SVG file upload in Kiwi TCMS

  kiwitcms · Kiwi

  High7.6