Kkiwitcms

Products

Exploited and recent CVEs

• CVE-2026-49292 None 0.0 Kiwi TCMS: The /init-db/ page renders and responds to requests after first use 0.4%
• CVE-2026-55630 None 0.0 Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase) 0.4%
• CVE-2026-54724 Medium 6.1 Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint 0.3%
• CVE-2023-36809 High 8.1 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox 0.7%
• CVE-2023-33977 High 8.1 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS 0.9%
• CVE-2023-32686 High 8.1 kiwitcms vulnerable to stored XSS via unrestricted files upload 0.4%
• CVE-2023-30628 High 8.8 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow 3.6%
• CVE-2023-30613 High 8.1 Kiwi TCMS unrestricted file upload vulnerability 1.0%
• CVE-2023-30544 Low 3.9 Kiwi TCMS may allow user to update email address to unverified one 0.4%
• CVE-2023-27489 High 7.6 Stored cross site scripting via SVG file upload in Kiwi TCMS 0.5%
• CVE-2023-25171 High 7.5 Kiwi TCMS has denial of service vulnerability on Password reset page 0.9%
• CVE-2023-25156 High 7.5 Kiwi TCMS has no protection against brute-force attacks on login page 0.9%
• CVE-2023-22451 Medium 6.5 Weak password requirements in Kiwi TCMS 0.7%
• CVE-2022-4105 High 7.1 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi 0.5%