Skip to content
OpenAdvisories

Package · PyPI

kiwitcms

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-77433

    Kiwi TCMS account confirmation open redirect through protocol-relative URLs

    ## Summary In Kiwi TCMS version 16.1, the fix for CVE-2026-54724 (open redirect via unvalidated `next` parameter) in the account confirmation endpoint is incomplete. The validation uses `startswith("/")` to check if the redirect URL is local, but this is bypa…

    kiwitcms PyPI
  • Medium 6.1
    CVE-2026-54724

    Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint

    Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arb…

    kiwitcms Kiwi kiwitcms PyPI