Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: getkirby Component: Panel Clear all filters
TI-2020-16076 CVE-2020-26255 · GHSA-g3h8-cg9x-47qw

PHP Phar archives could be uploaded and executed in Kirby

Priority MEDIUM 42

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01488 Published 2020-12-08 Fixed in 3.4.5, 2.5.14 CWE-434
TI-2020-16074 CVE-2020-26253 · GHSA-2ccx-2gf3-8xvv

.dev domains treated as local in Kirby

Priority LOW 31

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain.

CVSS 3.1MEDIUM 6.8 Network No auth No interaction EPSS 0.00568 Published 2020-12-08 Fixed in 3.3.6, 2.5.14 CWE-346
TI-2017-12363 CVE-2017-16807 · GHSA-275c-v3rc-xghx

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before…

Priority LOW 29

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.02422 Published 2017-11-13 Fixed in 2.3.3, 2.4.2 +1 CWE-79