getkirby

47 results · Feed

• Medium 5.9
  CVE-2022-36037

  Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby

  kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a type of vulnerability that allows execution of any kind of JavaScript code inside the Panel session…

  getkirby kirby getkirby/cms Packagist
  Aug 29, 2022
• High 7.3
  CVE-2021-41258

  Cross-site scripting (XSS) from image block content in the site frontend

  Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special…

  getkirby kirby getkirby/cms Packagist
  Nov 16, 2021
• High 7.3
  CVE-2021-41252

  Cross-site scripting (XSS) from writer field content in the site frontend

  Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not possible to escape HTML special characters against cross-site scripting (XSS) attacks, otherwise th…

  getkirby kirby getkirby/cms Packagist
  Nov 16, 2021
• High 7.1
  CVE-2021-32735

  Cross-site scripting (XSS) from field and configuration text displayed in the Panel

  Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. …

  getkirby kirby getkirby/cms Packagist
  Jul 2, 2021
• High 7.6
  CVE-2021-29460 Public exploit

  Cross-site scripting (XSS) from unsanitized uploaded SVG files

  Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like `<script>` tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that li…

  getkirby kirby getkirby/cms Packagist
  Apr 27, 2021
• Medium 6.8
  CVE-2020-26255

  PHP Phar archives could be uploaded and executed in Kirby

  Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have …

  getkirby kirby getkirby/cms getkirby/panel Packagist
  Dec 8, 2020
• Medium 6.8
  CVE-2020-26253

  .dev domains treated as local in Kirby

  Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that …

  getkirby kirby getkirby/cms getkirby/panel Packagist
  Dec 8, 2020