kiwitcms vulnerabilities

Products

• Kiwi 13
• kiwi tcms 11
• kiwitcms/kiwi 1

Latest kiwitcms CVEs

Newest publication first

1. CVE-2026-49292 Kiwi TCMS: The /init-db/ page renders and responds to requests after first use

   Published 2026-09-17

   None·CVSS 0.0 EPSS 0.44%

   Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so...

2. CVE-2026-55630 Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)

   Published 2026-09-15

   None·CVSS 0.0 EPSS 0.42%

   Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS mi...

3. CVE-2026-54724 Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint

   Published 2026-09-15

   Medium·CVSS 6.1 EPSS 0.35%

   Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domai...

4. CVE-2023-36809 Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox

   Published 2023-07-05

   Medium·CVSS 5.4 EPSS 0.69%

   Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing po...

5. CVE-2023-33977 Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS

   Published 2023-06-06

   Medium·CVSS 5.4 EPSS 0.87%

   Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files fr...

6. CVE-2023-32686 kiwitcms vulnerable to stored XSS via unrestricted files upload

   Published 2023-05-27

   Medium·CVSS 5.4 EPSS 0.43%

   Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files fr...

7. CVE-2023-30628 Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow

   Published 2023-04-24

   High·CVSS 8.8 EPSS 3.6%

   Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the changelog.yml workflow is vulnerable to command injection attacks because of using an untrusted github.head_ref field. The github.head_ref value is an...

8. CVE-2023-30613 Kiwi TCMS unrestricted file upload vulnerability

   Published 2023-04-24

   Critical·CVSS 9.0 EPSS 1.0%

   Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an .exe file or a file con...

9. CVE-2023-30544 Kiwi TCMS may allow user to update email address to unverified one

   Published 2023-04-24

   Medium·CVSS 4.3 EPSS 0.42%

   Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the My profile admin page. This page allowed them to change the email address registered with their account without the ownership verifi...

10. CVE-2023-27489 Stored cross site scripting via SVG file upload in Kiwi TCMS

    Published 2023-03-29

    Medium·CVSS 5.4 EPSS 0.49%

    Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code coul...

11. CVE-2023-25156 Kiwi TCMS has no protection against brute-force attacks on login page

    Published 2023-02-15

    Critical·CVSS 9.8 EPSS 0.91%

    Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and c...

12. CVE-2023-25171 Kiwi TCMS has denial of service vulnerability on Password reset page

    Published 2023-02-15

    Medium·CVSS 5.9 EPSS 0.92%

    Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email a...

13. CVE-2023-22451 Weak password requirements in Kiwi TCMS

    Published 2023-01-02

    High·CVSS 8.8 EPSS 0.74%

    Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults f...

14. CVE-2022-4105 Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi

    Published 2022-11-21

    Medium·CVSS 5.4 EPSS 0.51%

    A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.