Product by Kiwitcms
Kiwi
13 known vulnerabilities in Kiwi (Kiwitcms), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2023-30628 | Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow | 8.8 | |
| Critical | CVE-2023-30613 | Kiwi TCMS unrestricted file upload vulnerability | 8.1 | |
| High | CVE-2023-33977 | Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS | 8.1 | |
| High | CVE-2023-25171 | Kiwi TCMS has denial of service vulnerability on Password reset page | 7.5 | |
| Critical | CVE-2023-25156 | Kiwi TCMS has no protection against brute-force attacks on login page | 7.5 | |
| High | CVE-2023-36809 | Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox | 8.1 | |
| Medium | CVE-2026-54724 | Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint | 6.1 | |
| High | CVE-2023-22451 | Weak password requirements in Kiwi TCMS | 6.5 | |
| High | CVE-2023-32686 | kiwitcms vulnerable to stored XSS via unrestricted files upload | 8.1 | |
| High | CVE-2023-27489 | Stored cross site scripting via SVG file upload in Kiwi TCMS | 7.6 | |
| Not rated | CVE-2026-49292 | Kiwi TCMS: The /init-db/ page renders and responds to requests after first use | — | |
| Not rated | CVE-2026-55630 | Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase) | — | |
| Medium | CVE-2023-30544 | Kiwi TCMS may allow user to update email address to unverified one | 3.9 |