- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 13 · 9 high, 1 medium, 1 low
- Registry
- PyPI
Advisories 13
- CVE-2026-49292None 0.0
Kiwi TCMS: The /init-db/ page renders and responds to requests after first use
Affected: through 12.4.
- CVE-2026-55630None 0.0
Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
Affected: through 12.4.
- CVE-2026-54724Medium 6.1
Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint
Affected: through 12.4.
- CVE-2023-36809High 8.1
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
Affected: fixed in 12.5.
- CVE-2023-33977High 8.1
Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS
Affected: fixed in 12.4.
- CVE-2023-32686High 8.1
kiwitcms vulnerable to stored XSS via unrestricted files upload
Affected: fixed in 12.3.
- CVE-2023-30628High 8.8
Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow
Affected: fixed in 12.3.
- CVE-2023-30613High 8.1
Kiwi TCMS unrestricted file upload vulnerability
Affected: fixed in 12.2.
- CVE-2023-30544Low 3.9
Kiwi TCMS may allow user to update email address to unverified one
Affected: fixed in 12.2.
- CVE-2023-27489High 7.6
Stored cross site scripting via SVG file upload in Kiwi TCMS
Affected: fixed in 12.1.
- CVE-2023-25171High 7.5
Kiwi TCMS has denial of service vulnerability on Password reset page
Affected: fixed in 12.0.
- CVE-2023-25156High 7.5
Kiwi TCMS has no protection against brute-force attacks on login page
Affected: fixed in 12.0.
- CVE-2022-4105High 7.1
Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi
Affected: fixed in 11.6.