HIGH8.1PyPI
GHSA-2fqm-m4r2-fh98· CVE-2023-33977, PYSEC-2026-1495kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
Modified: 9/10/2026
package
PyPI/kiwitcms
pkg:pypi/kiwitcms
HIGH7.6PyPI
GHSA-2wcr-87wf-cf9j· CVE-2023-27489, PYSEC-2026-1496Kiwi TCMS Stored Cross-site Scripting via SVG file
Modified: 9/10/2026
—0.0PyPI
GHSA-473p-56xx-vg67· CVE-2026-55630, PYSEC-2026-2551Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Modified: 7/13/2026
HIGH7.5PyPI
GHSA-7968-h4m4-ghm9· CVE-2023-25156, PYSEC-2026-835No protection against brute-force attacks on login page
Modified: 9/10/2026
HIGH7.5PyPI
GHSA-7j9h-3jxf-3vrf· CVE-2023-25171, PYSEC-2026-836Denial of service vulnerability on Password reset page
Modified: 9/10/2026
—0.0PyPI
GHSA-7x6q-3v3m-cwjg· CVE-2023-30544, PYSEC-2026-1497kiwi TCMS has possibility for user to update email address to unverified one
Modified: 9/10/2026
HIGH7.7PyPI
GHSA-fwcf-753v-fgcj· CVE-2023-30613, PYSEC-2026-1498Unrestricted file upload in kiwi TCMS
Modified: 7/7/2026
MEDIUM5.4PyPI
GHSA-hf94-8mx5-2vvj· CVE-2022-4105, PYSEC-2026-837Cross-site Scripting in kiwitcms
Modified: 7/7/2026
MEDIUM6.1PyPI
GHSA-hmj5-jm8h-h9fh· CVE-2026-54724, PYSEC-2026-2552Kiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint
Modified: 7/13/2026
HIGH8.1PyPI
GHSA-jpgw-2r9m-8qfw· CVE-2023-36809, PYSEC-2026-1499Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
Modified: 7/7/2026
LOWPyPI
GHSA-v8rp-6xcv-fwgh· CVE-2026-49292, PYSEC-2026-2553Kiwi TCMS's /init-db/ page renders and responds to requests after first use
Modified: 7/13/2026
MEDIUM5.4PyPI
GHSA-x7c2-7wvg-jpx7· CVE-2023-32686, PYSEC-2026-1500kiwitcms vulnerable to stored XSS via unrestricted files upload
Modified: 9/10/2026
HIGH8.8PyPI
PYSEC-2023-273· CVE-2023-30628, GHSA-cw6r-6ccx-5hwxModified: 11/21/2024
HIGH8.1PyPI
PYSEC-2026-1495· CVE-2023-33977, GHSA-2fqm-m4r2-fh98kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
Modified: 7/7/2026
HIGH7.6PyPI
PYSEC-2026-1496· CVE-2023-27489, GHSA-2wcr-87wf-cf9jKiwi TCMS Stored Cross-site Scripting via SVG file
Modified: 7/7/2026
—0.0PyPI
PYSEC-2026-1497· CVE-2023-30544, GHSA-7x6q-3v3m-cwjgkiwi TCMS has possibility for user to update email address to unverified one
Modified: 7/7/2026
HIGH7.7PyPI
PYSEC-2026-1498· CVE-2023-30613, GHSA-fwcf-753v-fgcjUnrestricted file upload in kiwi TCMS
Modified: 7/7/2026
HIGH8.1PyPI
PYSEC-2026-1499· CVE-2023-36809, GHSA-jpgw-2r9m-8qfwKiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
Modified: 7/7/2026
MEDIUM5.4PyPI
PYSEC-2026-1500· CVE-2023-32686, GHSA-x7c2-7wvg-jpx7kiwitcms vulnerable to stored XSS via unrestricted files upload
Modified: 7/7/2026
—0.0PyPI
PYSEC-2026-2551· CVE-2026-55630, GHSA-473p-56xx-vg67Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Modified: 7/13/2026
MEDIUM6.1PyPI
PYSEC-2026-2552· CVE-2026-54724, GHSA-hmj5-jm8h-h9fhKiwi TCMS has an Open Redirect via unvalidated next parameter in account confirmation endpoint
Modified: 7/13/2026
—PyPI
PYSEC-2026-2553· CVE-2026-49292, GHSA-v8rp-6xcv-fwghKiwi TCMS's /init-db/ page renders and responds to requests after first use
Modified: 7/13/2026
HIGH7.5PyPI
PYSEC-2026-835· CVE-2023-25156, GHSA-7968-h4m4-ghm9No protection against brute-force attacks on login page
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-836· CVE-2023-25171, GHSA-7j9h-3jxf-3vrfDenial of service vulnerability on Password reset page
Modified: 7/7/2026
MEDIUM5.4PyPI
PYSEC-2026-837· CVE-2022-4105, GHSA-hf94-8mx5-2vvjCross-site Scripting in kiwitcms
Modified: 7/7/2026