Description
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kiwitcms | kiwitcms/kiwi | unspecified – < 11.6 | 11.6 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | kiwitcms | < 11.6 | 11.6 | GHSA-hf94-8mx5-2vvj |