Read the docs

getkirby

Records62All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high23CVSS 7.0–8.9

Exploited now

getkirby records in CISA KEV

No getkirby vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Kirby 41 records HIGH Panel 3 records MEDIUM Starterkit 1 record LOW Webmentions 1 record MEDIUM

Records

3 records in Panel · all components

TI-2020-16076 CVE-2020-26255 · GHSA-g3h8-cg9x-47qw

PHP Phar archives could be uploaded and executed in Kirby

Priority MEDIUM 42

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01488 Published 2020-12-08 Fixed in 3.4.5, 2.5.14 CWE-434
TI-2020-16074 CVE-2020-26253 · GHSA-2ccx-2gf3-8xvv

.dev domains treated as local in Kirby

Priority LOW 31

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00568 Published 2020-12-08 Fixed in 3.3.6, 2.5.14 CWE-346
TI-2017-12363 CVE-2017-16807 · GHSA-275c-v3rc-xghx

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before…

Priority LOW 29

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02422 Published 2017-11-13 Fixed in 2.3.3, 2.4.2 +1 CWE-79
Open these records in search →