Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
154 results · page 1 of 4
Oct 19, 2026A weakness has been identified in kiwilan php-archive up to 2.3.02.CVE-2026-112302 · Other software · kiwilan · reported by VulDBLow 2.1
A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- php-archive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 17, 2026Kiwi TCMS is an open source test management system.CVE-2026-49292 · Other software · kiwitcms · reported by GitHubNone
Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reachable after initial setup and proxies repeated requests to Kiwi/manage.py migrate. The migration command is reentrant, so repeated access reports that no migrations are available and does not cause data loss, alter application state, reveal confidential information, or produce a documented availability impact. This issue is fixed in version 16.0.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Kiwi TCMS is an open source test management system.CVE-2026-55630 · Other software · kiwitcms · reported by GitHubNone
Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null. This issue is fixed in version 16.1.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026Kiwi TCMS is an open source test management system.CVE-2026-54724 · Other software · kiwitcms · reported by GitHubMedium 6.1
Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g.CVE-2026-84700 · Other software · OpenAtomFoundation · reported by VulnCheckHigh 8.8
PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g. 11221 when the default client port 9221 is used) that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as masterauth inside its MetaSync request — only the MetaSync handler (HandleMetaSyncRequest) validates it; the frame dispatcher (DealMessage) does not require a completed or attempted MetaSync before routing other message types to their handlers. As a result, an unauthenticated remote attacker can connect directly to the replication port and issue TrySync, DBSync, BinlogSync, and RemoveSlaveNode requests, obtaining the full-sync snapshot and live write stream and removing replica nodes, even when requirepass is configured.
- Product
- pikiwidb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2025The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled websiCVE-2025-11190 · Other software · Synchroweb · reported by cret@cert.orgMedium 5.4
The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.
- Product
- Kiwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynchroweb.comkb.cert.org
Oct 10, 2025The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.CVE-2025-11189 · Other software · Synchroweb · reported by cret@cert.orgHigh 7.3
The Kiwire Captive Portal contains a reflected cross-site scripting (XSS) vulnerability within the login-url parameter, allowing for Javascript execution.
- Product
- Kiwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynchroweb.comkb.cert.org
Oct 10, 2025The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding datCVE-2025-11188 · Other software · Synchroweb · reported by cret@cert.orgHigh 7.3
The Kiwire Captive Portal contains a blind SQL injection in the nas-id parameter, allowing for SQL commands to be issued and to compromise the corresponding database.
- Product
- Kiwire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynchroweb.comkb.cert.org
Sep 5, 2025Kiwi: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58790 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through <= 2.1.8.
- Product
- Kiwi
- Affected
- up to 2.1.8
- What to do
- Affects up to 2.1.8. Update Kiwi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 1, 2025KiwiChat NextClient: Stored Cross-Site ScriptingCVE-2025-3670 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The KiwiChat NextClient plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- KiwiChat NextClient
- Affected
- up to 6.2
- What to do
- Affects up to 6.2. Update KiwiChat NextClient to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Feb 11, 2025Sensitive data could be exposed to non- privileged users in a configuration file.CVE-2024-45718 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 4.6
Sensitive data could be exposed to non- privileged users in a configuration file. Local access to the computer with a low- privileged account is required to access the configuration file containing the sensitive data.
- Product
- Kiwi Syslog NG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Oct 17, 2024SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes.CVE-2024-45713 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.1
SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes.
- Product
- Kiwi CatTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2024Social Sharing Plugin – Kiwi: Information ExposureCVE-2024-3228 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Social Sharing Plugin – Kiwi plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.1.7 via the 'kiwi-nw-pinterest' class. This makes it possible for unauthenticated attackers to view limited content from password protected posts.
- Product
- Social Sharing Plugin – Kiwi
- Affected
- up to 2.1.7
- What to do
- Affects up to 2.1.7. Update Social Sharing Plugin – Kiwi to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 5, 2023Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc.CVE-2023-36809 · Other software · kiwitcms · reported by GitHubHigh 8.1
Kiwi TCMS, an open source test management system allows users to upload attachments to test plans, test cases, etc. Versions of Kiwi TCMS prior to 12.5 had introduced changes which were meant to serve all uploaded files as plain text in order to prevent browsers from executing potentially dangerous files when such files are accessed directly. The previous Nginx configuration was incorrect allowing certain browsers like Firefox to ignore the `Content-Type: text/plain` header on some occasions thus allowing potentially dangerous scripts to be executed. Additionally, file upload validators and parts of the HTML rendering code had been found to require additional sanitation and improvements. Version 12.5 fixes this vulnerability with updated Nginx content type configuration, improved file upload validation code to prevent more potentially dangerous uploads, and Sanitization of test plan names used in the `tree_view_html()` function.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023Kiwi Social Share: Authorization bypassCVE-2021-4362 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_get_option() function called via the kiwi_social_share_get_option AJAX action in version 2.1.0. This makes it possible for unauthenticated attackers to read and modify arbitrary options on a WordPress site that can be used for complete site takeover. This was a previously fixed vulnerability that was reintroduced in this version.
- Product
- Kiwi Social Share
- Affected
- 2.1.0 to 2.1.0
- What to do
- Affects 2.1.0 to 2.1.0. Update Kiwi Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Jun 6, 2023Kiwi TCMS is an open source test management system for both manual and automated testing.CVE-2023-33977 · Other software · kiwitcms · reported by GitHubHigh 8.1
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. This issue has been addressed in version 12.4. Users are advised to upgrade. Users unable to upgrade who are serving Kiwi TCMS behind a reverse proxy should make sure that additional header values are still passed to the client browser. If they aren't redefining them inside the proxy configuration.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2023Kiwi TCMS is an open source test management system for both manual and automated testing.CVE-2023-32686 · Other software · kiwitcms · reported by GitHubHigh 8.1
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded. The upload validation checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially dangerous file. Exploiting this flaw, a combination of files could be uploaded so that they work together to circumvent the existing Content-Security-Policy and allow execution of arbitrary JavaScript in the browser. This issue has been patched in version 12.3.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comkiwitcms.org
May 15, 2023KIWIZ Invoices Certification & PDF System: Does not validate the path of files to be downloadedCVE-2023-2180 · WordPress plugins & themes · reported by WPScanHigh 7.5
The KIWIZ Invoices Certification & PDF System WordPress plugin through 2.1.3 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downlaod arbitrary files, as well as perform PHAR unserialization (assuming they can upload a file on the server)
- Product
- KIWIZ Invoices Certification & PDF System
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update KIWIZ Invoices Certification & PDF System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2023Kiwi TCMS is an open source test management system.CVE-2023-30628 · Other software · kiwitcms · reported by GitHubHigh 8.8
Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the `changelog.yml` workflow is vulnerable to command injection attacks because of using an untrusted `github.head_ref` field. The `github.head_ref` value is an attacker-controlled value. Assigning the value to `zzz";echo${IFS}"hello";#` can lead to command injection. Since the permission is not restricted, the attacker has a write-access to the repository. Commit 834c86dfd1b2492ccad7ebbfd6304bfec895fed2 of the kiwitcms/Kiwi repository and commit e39f7e156fdaf6fec09a15ea6f4e8fec8cdbf751 of the kiwitcms/enterprise repository contain a fix for this issue.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc.CVE-2023-30613 · Other software · kiwitcms · reported by GitHubHigh 8.1
Kiwi TCMS, an open source test management system, allows users to upload attachments to test plans, test cases, etc. In versions of Kiwi TCMS prior to 12.2, there is no control over what kinds of files can be uploaded. Thus, a malicious actor may upload an `.exe` file or a file containing embedded JavaScript and trick others into clicking on these files, causing vulnerable browsers to execute malicious code on another computer. Kiwi TCMS v12.2 comes with functionality that allows administrators to configure additional upload validator functions which give them more control over what file types are accepted for upload. By default `.exe` are denied. Other files containing the `<script>` tag, regardless of their type are also denied b/c they are a path to XSS attacks. There are no known workarounds aside from upgrading.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Kiwi TCMS is an open source test management system.CVE-2023-30544 · Other software · kiwitcms · reported by GitHubLow 3.9
Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 29, 2023Kiwi TCMS is an open source test management system for both manual and automated testing.CVE-2023-27489 · Other software · kiwitcms · reported by GitHubHigh 7.6
Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute. This vulnerability has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header which blocks inline JavaScript in all modern browsers. This configuration change is provided in version 12.1 and users are advised to upgrade. Users unable to upgrade may set their Content-Security-Policy HTTP header manually.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0.CVE-2023-25171 · Other software · kiwitcms · reported by GitHubHigh 7.5
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt denial-of-service attacks against the Password reset page. An attacker could potentially send a large number of emails if they know the email addresses of users in Kiwi TCMS. Additionally that may strain SMTP resources. Users should upgrade to v12.0 or later to receive a patch. As potential workarounds, users may install and configure a rate-limiting proxy in front of Kiwi TCMS and/or configure rate limits on their email server when possible.
- Product
- kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 15, 2023Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0.CVE-2023-25156 · Other software · kiwitcms · reported by GitHubHigh 7.5
Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.
- Product
- kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023Kiwi TCMS is an open source test management system.CVE-2023-22451 · Other software · kiwitcms · reported by GitHubMedium 6.5
Kiwi TCMS is an open source test management system. In version 11.6 and prior, when users register new accounts and/or change passwords, there is no validation in place which would prevent them from picking an easy to guess password. This issue is resolved by providing defaults for the `AUTH_PASSWORD_VALIDATORS` configuration setting. As of version 11.7, the password can’t be too similar to other personal information, must contain at least 10 characters, can’t be a commonly used password, and can’t be entirely numeric. As a workaround, an administrator may reset all passwords in Kiwi TCMS if they think a weak password may have been chosen.
- Product
- Kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2022A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) andCVE-2022-4105 · Other software · kiwitcms · reported by security@huntr.devMedium 5.4
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
- Product
- kiwitcms/kiwi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 23, 2022Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors.CVE-2022-36350 · Other software · PukiWiki Development Team · reported by vultures@jpcert.or.jpMedium 5.4
Stored cross-site scripting vulnerability in PukiWiki versions 1.3.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- PukiWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jppukiwiki.osdn.jp
Aug 23, 2022Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious CVE-2022-34486 · Other software · PukiWiki Development Team · reported by vultures@jpcert.or.jpHigh 7.2
Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious script via unspecified vectors.
- Product
- PukiWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jppukiwiki.osdn.jp
Aug 23, 2022Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors.CVE-2022-27637 · Other software · PukiWiki Development Team · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in PukiWiki versions 1.5.1 to 1.5.3 allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- PukiWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jppukiwiki.osdn.jp
Mar 25, 2022libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter.CVE-2022-27920 · Other software · Kiwix · reported by MITREMedium 6.1
libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0.
- Product
- Libkiwix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2021A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking.CVE-2021-35237 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5
A missing HTTP header (X-Frame-Options) in Kiwi Syslog Server has left customers vulnerable to click jacking. Clickjacking is an attack that occurs when an attacker uses a transparent iframe in a window to trick a user into clicking on an actionable item, such as a button or link, to another server in which they have an identical webpage. The attacker essentially hijacks the user activity intended for the original server and sends them to the other server. This is an attack on both the user and the server.
- Product
- Kiwi Syslog Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Oct 28, 2021TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php.CVE-2021-36551 · Other software · Tiki · reported by MITREMedium 5.4
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module.
- Product
- Tikiwiki Cms/groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2021TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php.CVE-2021-36550 · Other software · Tiki · reported by MITREMedium 5.4
TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Create category module.
- Product
- Tikiwiki Cms/groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2021The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions.CVE-2021-35236 · Other software · SolarWinds · reported by psirt@solarwinds.comLow 3.1
The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP, there is a potential for the cookie can be sent in clear text.
- Product
- Kiwi Syslog Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Oct 26, 2021The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions.CVE-2021-35235 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.3
The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely monitor and control the execution of an application. If an attacker could successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure that may be valuable in targeting SWI with malicious intent.
- Product
- Kiwi Syslog Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Oct 26, 2021The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier.CVE-2021-35233 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.3
The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client. This may lead to the disclosure of sensitive information such as internal authentication headers appended by reverse proxies.
- Product
- Kiwi Syslog Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Oct 25, 2021As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges byCVE-2021-35231 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.7
As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry. Example vulnerable path: "Computer\HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Kiwi Syslog Server\Parameters\Application".
- Product
- Kiwi Syslog Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.solarwinds.comsolarwinds.com
Oct 22, 2021As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by inseCVE-2021-35230 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.7
As a result of an unquoted service path vulnerability present in the Kiwi CatTools Installation Wizard, a local attacker could gain escalated privileges by inserting an executable into the path of the affected service or uninstall entry.
- Product
- Kiwi CatTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsolarwinds.comsolarwinds.com
Dec 11, 2020TikiWiki 21.2 allows templates to be edited without CSRF protection.CVE-2020-29254 · Other software · Tiki · reported by MITREHigh 8.8
TikiWiki 21.2 allows templates to be edited without CSRF protection. This could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected system. The vulnerability is due to insufficient CSRF protections for the web-based management interface of the affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a maliciously crafted link. A successful exploit could allow the attacker to perform arbitrary actions on an affected system with the privileges of the user. These action include allowing attackers to submit their own code through an authenticated user resulting in local file Inclusion. If an authenticated user who is able to edit TikiWiki templates visits an malicious website, template code can be edited.
- Product
- Tikiwiki Cms/groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 21, 2019Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script oCVE-2015-2793 · Other software · ikiwiki · reported by security@debian.orgMedium 6.1
Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi.
- Product
- ikiwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Oct 30, 2019A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment.CVE-2010-1673 · Other software · Ikiwiki · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in ikiwiki before 3.20101112 allows remote attackers to inject arbitrary web script or HTML via a comment.
- Product
- Ikiwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordikiwiki.infosecurity-tracker.debian.org
Oct 29, 2019ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks.CVE-2011-1408 · Other software · Ikiwiki · reported by MITREHigh 8.2
ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks.
- Product
- Ikiwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordikiwiki.infosecurity-tracker.debian.org
Oct 29, 2019Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments.CVE-2011-0428 · Other software · Ikiwiki · reported by MITREMedium 6.1
Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments.
- Product
- Ikiwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordikiwiki.infosecurity-tracker.debian.org
Sep 25, 2019The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or taCVE-2015-9434 · WordPress plugins & themes · reported by MITREMedium 6.5
The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
- Product
- kiwi-logo-carousel
- Fixed in
- 1.7.2
- What to do
- Update kiwi-logo-carousel to 1.7.2 or newer.
Aug 22, 2019tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fiCVE-2019-15314 · Other software · Tiki · reported by MITREMedium 5.4
tiki/tiki-upload_file.php in Tiki 18.4 allows remote attackers to upload JavaScript code that is executed upon visiting a tiki/tiki-download_file.php?display&fileId= URI.
- Product
- Tikiwiki Cms/groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.compastebin.com
Jun 5, 2019ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin.CVE-2019-9187 · Other software · Ikiwiki · reported by MITREHigh 7.5
ikiwiki before 3.20170111.1 and 3.2018x and 3.2019x before 3.20190228 allows SSRF via the aggregate plugin. The impact also includes reading local files via file: URIs.
- Product
- Ikiwiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordikiwiki.infoikiwiki.info
Jan 15, 2019In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.CVE-2018-20719 · Other software · Tiki · reported by MITREHigh 8.8
In Tiki before 17.2, the user task component is vulnerable to a SQL Injection via the tiki-user_tasks.php show_history parameter.
- Product
- Tikiwiki Cms/groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.ripstech.comblog.ripstech.com
Nov 15, 2018YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of CPU and memory resources and may resultCVE-2018-0700 · Other software · Hiroshi Yuki · reported by vultures@jpcert.or.jpHigh 7.5
YukiWiki 2.1.3 and earlier does not process a particular request properly that may allow consumption of large amounts of CPU and memory resources and may result in causing a denial of service condition.
- Product
- YukiWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2018Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2018-0699 · Other software · Hiroshi Yuki · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in YukiWiki 2.1.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- YukiWiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2018Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrCVE-2018-14850 · Other software · Tiki · reported by MITREMedium 5.4
Stored XSS vulnerabilities in Tiki before 18.2, 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image.
- Product
- Tikiwiki Cms/groupware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.