Vulnerabilities

TI-2026-36478 CVE-2026-49292 · GHSA-v8rp-6xcv-fwgh

Kiwi TCMS: The /init-db/ page renders and responds to requests after first use

LOW 9

Kiwi TCMS is an open source test management system.

CVSS 3.1N/A 0.0 Network No auth No interaction EPSS 0.00439 Published 2026-09-17 Fixed in 16.0 CWE-862

TI-2026-40157 CVE-2026-55630 · GHSA-473p-56xx-vg67

Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)

LOW 3

Kiwi TCMS is an open source test management system.

CVSS 3.1N/A 0.0 Network No auth User interaction EPSS 0.0042 Published 2026-09-15 Fixed in 16.1 CWE-79

TI-2026-39538 CVE-2026-54724 · GHSA-hmj5-jm8h-h9fh

Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint

LOW 27

Kiwi TCMS is an open source test management system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00347 Published 2026-09-15 Fixed in 16.1 CWE-601

TI-2023-18603 CVE-2023-36809 · GHSA-jpgw-2r9m-8qfw

Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox

HIGH 70

Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00692 Published 2023-07-05 Fixed in 12.5 CWE-434

TI-2023-16845 CVE-2023-33977 · GHSA-2fqm-m4r2-fh98

Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS

HIGH 70

Kiwi TCMS is an open source test management system for both manual and automated testing.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.0087 Published 2023-06-06 Fixed in 12.4 CWE-79

TI-2023-15962 CVE-2023-32686 · GHSA-x7c2-7wvg-jpx7

kiwitcms vulnerable to stored XSS via unrestricted files upload

LOW 38

Kiwi TCMS is an open source test management system for both manual and automated testing.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00431 Published 2023-05-27 Fixed in 12.3 CWE-434

TI-2023-14444 CVE-2023-30628

Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow

HIGH 73

Kiwi TCMS is an open source test management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03596 Published 2023-04-24 No fix listed CWE-78

TI-2023-14429 CVE-2023-30613 · GHSA-fwcf-753v-fgcj

Kiwi TCMS unrestricted file upload vulnerability

HIGH 74

Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.01024 Published 2023-04-24 Fixed in 12.2 CWE-434

TI-2023-14379 CVE-2023-30544 · GHSA-7x6q-3v3m-cwjg

Kiwi TCMS may allow user to update email address to unverified one

MEDIUM 53

Kiwi TCMS is an open source test management system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00419 Published 2023-04-24 Fixed in 12.2 CWE-283

TI-2023-12217 CVE-2023-27489 · GHSA-2wcr-87wf-cf9j

Stored cross site scripting via SVG file upload in Kiwi TCMS

LOW 36

Kiwi TCMS is an open source test management system for both manual and automated testing.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00485 Published 2023-03-29 Fixed in 12.1 CWE-79

TI-2023-10633 CVE-2023-25171 · GHSA-7j9h-3jxf-3vrf

Kiwi TCMS has denial of service vulnerability on Password reset page

MEDIUM 41

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00916 Published 2023-02-15 Fixed in 12.0 CWE-770

TI-2023-10618 CVE-2023-25156 · GHSA-7968-h4m4-ghm9

Kiwi TCMS has no protection against brute-force attacks on login page

MEDIUM 50

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0091 Published 2023-02-15 Fixed in 12.0 CWE-770

TI-2023-08701 CVE-2023-22451

Weak password requirements in Kiwi TCMS

LOW 39

Kiwi TCMS is an open source test management system.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0074 Published 2023-01-02 No fix listed CWE-521

TI-2022-03753 CVE-2022-4105 · GHSA-hf94-8mx5-2vvj

Cross-site Scripting (XSS) - Stored in kiwitcms/kiwi

HIGH 66

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history pag…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00506 Published 2022-11-21 Fixed in 11.6 CWE-79

Vulnerabilities

Filters