Priority HIGH 73
An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00966 · Published 2024-02-22 · Fixed in 3.6.6.5, 3.7.5.4 +4 CWE-94
Priority HIGH 66
An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0.
CVSS 3.1HIGH 7.1· Local · Low privileges · No interaction · EPSS 0.0032 · Published 2024-02-22 · No fix listed CWE-80
Priority MEDIUM 62
Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00463 · Published 2026-03-26 · No fix listed CWE-20
Priority MEDIUM 60
A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00429 · Published 2024-02-22 · No fix listed CWE-79
Priority MEDIUM 58
An issue was discovered in Kirby 2.5.12.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00714 · Published 2022-08-24 · No fix listed CWE-79
Priority MEDIUM 55
Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00405 · Published 2024-02-22 · Fixed in 3.6.6.5, 3.7.5.4 +4 CWE-79
Priority MEDIUM 46
Kirby is a content management system.
CVSS 3.1CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.01701 · Published 2023-07-27 · Fixed in 3.5.8.3, 3.6.6.3 +4 CWE-611
Priority MEDIUM 42
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.01488 · Published 2020-12-08 · Fixed in 3.4.5, 2.5.14 CWE-434
Priority MEDIUM 41
Kirby is a content management system.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01178 · Published 2023-07-27 · Fixed in 3.5.8.3, 3.6.6.3 +4 CWE-770
Priority MEDIUM 40
Kirby is a content management system.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00924 · Published 2023-07-27 · Fixed in 3.5.8.3, 3.6.6.3 +4 CWE-140
Priority LOW 39
Kirby is an open source CMS.
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.03174 · Published 2021-04-27 · Fixed in 3.5.4 CWE-79
Priority LOW 37
Kirby is an open-source content management system.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00363 · Published 2026-04-24 · Fixed in 4.9.0, 5.4.0 CWE-863
Priority LOW 36
Kirby is a CMS targeting designers and editors.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.0048 · Published 2024-08-29 · Fixed in 3.6.6.6, 3.7.5.5 +4 CWE-863
Priority LOW 36
Kirby is a content management system.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00809 · Published 2023-07-27 · Fixed in 3.5.8.3, 3.6.6.3 +4 CWE-613
Priority LOW 36
Kirby is a Content Management System.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.0079 · Published 2022-10-25 · Fixed in 3.5.8.2, 3.6.6.2 +2 CWE-204
Priority LOW 35
Kirby is an open-source content management system.
CVSS 4.0HIGH 7.6· Network · Low privileges · No interaction · EPSS 0.00334 · Published 2026-04-24 · Fixed in 4.9.0, 5.4.0 CWE-1336
Priority LOW 34
Kirby is an open source file structured CMS.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00807 · Published 2021-11-16 · Fixed in 3.5.8 CWE-79
Priority LOW 34
Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code.
CVSS 3.1HIGH 7.3· Network · Low privileges · User interaction · EPSS 0.00927 · Published 2021-11-16 · Fixed in 3.5.8 CWE-79
Priority LOW 32
Kirby is a content management system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00532 · Published 2021-07-02 · Fixed in 3.5.7 CWE-80
Priority LOW 31
Kirby is an open-source content management system.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00303 · Published 2026-05-09 · Fixed in 4.9.0, 5.4.0 CWE-862
Priority LOW 31
Kirby is an open-source content management system.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00231 · Published 2026-05-09 · Fixed in 4.9.0, 5.4.0 CWE-862
Priority LOW 31
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain.
CVSS 3.1MEDIUM 6.8· Network · No auth · No interaction · EPSS 0.00568 · Published 2020-12-08 · Fixed in 3.3.6, 2.5.14 CWE-346
Priority LOW 30
Kirby is an open-source content management system.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00346 · Published 2026-04-24 · Fixed in 4.9.0, 5.4.0 CWE-91
Priority LOW 29
Kirby is an open-source content management system.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0059 · Published 2025-05-13 · Fixed in 3.9.8.3, 3.10.1.2 +1 CWE-22
Priority LOW 29
Kirby is an open-source content management system.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00714 · Published 2025-05-13 · Fixed in 3.9.8.3, 3.10.1.2 +1 CWE-22
Load more
THREATIST.IORead the docs