getkirby/cms (Packagist)
Advisories
127
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.5.2 or later clears every advisory below that has a fix.
Upgrade commands
composer
composer require getkirby/cms:^5.5.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-9vx2-j98c-p72w Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling |
High EPSS 0.76% |
>= 5.0.0, < 5.5.2 | 5.5.2 |
| GHSA-9vx2-j98c-p72w Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling |
High EPSS 0.76% |
< 4.9.5 | 4.9.5 |
| GHSA-6j4c-mgqr-qv76 Kirby: Access to image files outside of the site root via path traversal in the media handling |
Medium EPSS 0.68% |
< 4.9.5 | 4.9.5 |
| GHSA-6j4c-mgqr-qv76 Kirby: Access to image files outside of the site root via path traversal in the media handling |
Medium EPSS 0.68% |
>= 5.0.0, < 5.5.2 | 5.5.2 |
| GHSA-67mx-6wf2-92xp Kirby: File upload permissions are not checked during processing of chunk data |
High EPSS 0.43% |
>= 5.0.0, < 5.5.2 | 5.5.2 |
| GHSA-rf2p-vh74-7vvh Kirby: System path exposure from error messages in the REST API |
Medium EPSS 0.70% |
>= 5.0.0, < 5.5.2 | 5.5.2 |
| GHSA-rf2p-vh74-7vvh Kirby: System path exposure from error messages in the REST API |
Medium EPSS 0.70% |
< 4.9.5 | 4.9.5 |
| GHSA-r3w8-2c5r-h9j9 Kirby: `pages.access` permission is not checked in the `site/find` REST API route |
High EPSS 0.43% |
< 4.9.4 | 4.9.4 |
| GHSA-r3w8-2c5r-h9j9 Kirby: `pages.access` permission is not checked in the `site/find` REST API route |
High EPSS 0.43% |
>= 5.0.0-alpha.1, < 5.4.4 | 5.4.4 |
| GHSA-89cp-7p28-jffg Kirby: Access to files of top-level drafts is not protected by permissions |
Medium EPSS 0.50% |
< 4.9.4 | 4.9.4 |
| GHSA-89cp-7p28-jffg Kirby: Access to files of top-level drafts is not protected by permissions |
Medium EPSS 0.50% |
>= 5.0.0-alpha.1, < 5.4.4 | 5.4.4 |
| GHSA-whxw-24jc-cwmv Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header |
Critical EPSS 0.74% |
>= 5.0.0-alpha.1, < 5.4.4 | 5.4.4 |
| GHSA-whxw-24jc-cwmv Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header |
Critical EPSS 0.74% |
< 4.9.4 | 4.9.4 |
| GHSA-wr9h-4r83-f4v6 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` |
High EPSS 0.55% |
>= 5.0.0-alpha.1, < 5.4.4 | 5.4.4 |
| GHSA-wr9h-4r83-f4v6 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` |
High EPSS 0.55% |
< 4.9.4 | 4.9.4 |
| GHSA-4v4h-m2qq-ppgw Kirby: Request header injection in `Http\Remote` |
Medium EPSS 0.44% |
>= 5.0.0-alpha.1, < 5.4.4 | 5.4.4 |
| GHSA-4v4h-m2qq-ppgw Kirby: Request header injection in `Http\Remote` |
Medium EPSS 0.44% |
< 4.9.4 | 4.9.4 |
| GHSA-rhj6-r49h-5932 Kirby: Self cross-site scripting (self-XSS) in the writer field |
High EPSS 0.43% |
>= 5.0.0-alpha.1, < 5.4.4 | 5.4.4 |
| GHSA-rhj6-r49h-5932 Kirby: Self cross-site scripting (self-XSS) in the writer field |
High EPSS 0.43% |
< 4.9.4 | 4.9.4 |
| GHSA-23q2-54qv-rq5x Kirby: `pages.access` permission is not checked in the pages picker for parent pages |
Medium EPSS 0.48% |
>= 5.0.0-alpha.1, < 5.4.4 | 5.4.4 |
| GHSA-23q2-54qv-rq5x Kirby: `pages.access` permission is not checked in the pages picker for parent pages |
Medium EPSS 0.48% |
< 4.9.4 | 4.9.4 |
| GHSA-qvjf-922g-pj44 Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend |
High EPSS 0.53% |
>= 5.0.0, < 5.4.1 | 5.4.1 |
| GHSA-qvjf-922g-pj44 Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend |
High EPSS 0.53% |
< 4.9.1 | 4.9.1 |
| GHSA-39vq-49qm-r2mc Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions |
Medium EPSS 0.36% |
< 4.9.1 | 4.9.1 |
| GHSA-39vq-49qm-r2mc Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions |
Medium EPSS 0.36% |
>= 5.0.0, < 5.4.1 | 5.4.1 |
| GHSA-9hx7-c53c-v6x8 Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup |
High EPSS 1.77% |
>= 5.3.0, < 5.4.1 | 5.4.1 |
| GHSA-2xw4-v2wx-hqq9 Kirby CMS's `pages.access` permission is not checked during rendering of page drafts |
Medium EPSS 0.36% |
< 4.9.1 | 4.9.1 |
| GHSA-2xw4-v2wx-hqq9 Kirby CMS's `pages.access` permission is not checked during rendering of page drafts |
Medium EPSS 0.36% |
>= 5.0.0, < 5.4.1 | 5.4.1 |
| GHSA-5fhx-9q32-q257 Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend |
High EPSS 0.43% |
< 4.9.1 | 4.9.1 |
| GHSA-5fhx-9q32-q257 Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend |
High EPSS 0.43% |
>= 5.0.0, < 5.4.1 | 5.4.1 |
| GHSA-86rh-h242-j8xp Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints |
High EPSS 0.49% |
>= 5.0.0, < 5.4.1 | 5.4.1 |
| GHSA-86rh-h242-j8xp Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints |
High EPSS 0.49% |
< 4.9.1 | 4.9.1 |
| GHSA-x68m-c7jf-2572 Kirby CMS's system API endpoint leaks installed version and license data to authenticated users |
Medium EPSS 0.19% |
< 4.9.0 | 4.9.0 |
| GHSA-x68m-c7jf-2572 Kirby CMS's system API endpoint leaks installed version and license data to authenticated users |
Medium EPSS 0.19% |
>= 5.0.0, < 5.4.0 | 5.4.0 |
| GHSA-39cp-6679-8xv2 Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions |
Medium EPSS 0.24% |
>= 5.0.0, < 5.4.0 | 5.4.0 |
| GHSA-39cp-6679-8xv2 Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions |
Medium EPSS 0.24% |
< 4.9.0 | 4.9.0 |
| GHSA-2h7v-4372-f6x2 Kirby CMS's read access to site, user and role information is not gated by permissions |
Medium EPSS 0.23% |
>= 5.0.0, < 5.4.0 | 5.4.0 |
| GHSA-2h7v-4372-f6x2 Kirby CMS's read access to site, user and role information is not gated by permissions |
Medium EPSS 0.23% |
< 4.9.0 | 4.9.0 |
| GHSA-85x2-r8xv-ww8c Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API |
Medium EPSS 0.30% |
>= 5.0.0, < 5.4.0 | 5.4.0 |
| GHSA-85x2-r8xv-ww8c Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API |
Medium EPSS 0.30% |
< 4.9.0 | 4.9.0 |
| GHSA-6gqr-mx34-wh8r Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection |
High EPSS 0.36% |
>= 5.0.0, < 5.4.0 | 5.4.0 |
| GHSA-6gqr-mx34-wh8r Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection |
High EPSS 0.36% |
< 4.9.0 | 4.9.0 |
| GHSA-w942-j9r6-hr6r Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter |
Medium EPSS 0.27% |
< 4.9.0 | 4.9.0 |
| GHSA-w942-j9r6-hr6r Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter |
Medium EPSS 0.27% |
>= 5.0.0, < 5.4.0 | 5.4.0 |
| GHSA-jcjw-58rv-c452 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering |
High EPSS 0.33% |
< 4.9.0 | 4.9.0 |
| GHSA-jcjw-58rv-c452 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering |
High EPSS 0.33% |
>= 5.0.0, < 5.4.0 | 5.4.0 |
| GHSA-9wfj-c55w-j9qr Kirby has XML injection in its XML creator toolkit |
High EPSS 0.35% |
>= 5.0.0, < 5.4.0 | 5.4.0 |
| GHSA-9wfj-c55w-j9qr Kirby has XML injection in its XML creator toolkit |
High EPSS 0.35% |
< 4.9.0 | 4.9.0 |
| GHSA-cw7v-45wm-mcf2 Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload Withdrawn |
Medium EPSS 0.46% |
< 5.2.0-rc.1 | 5.2.0-rc.1 |
| GHSA-4j78-4xrm-cr2f Kirby is missing permission checks in the content changes API |
Medium EPSS 0.23% |
>= 5.0.0, < 5.2.2 | 5.2.2 |
| GHSA-84hf-8gh5-575j Kirby CMS has cross-site scripting (XSS) in the changes dialog |
Medium EPSS 0.20% |
>= 5.0.0, < 5.1.4 | 5.1.4 |
| GHSA-x275-h9j4-7p4h Kirby vulnerable to path traversal of collection names during file system lookup |
Critical EPSS 0.59% |
>= 4.0.0, < 4.7.1 | 4.7.1 |
| GHSA-x275-h9j4-7p4h Kirby vulnerable to path traversal of collection names during file system lookup |
Critical EPSS 0.59% |
< 3.9.8.3 | 3.9.8.3 |
| GHSA-x275-h9j4-7p4h Kirby vulnerable to path traversal of collection names during file system lookup |
Critical EPSS 0.59% |
>= 3.10.0, < 3.10.1.2 | 3.10.1.2 |
| GHSA-9p3p-w5jf-8xxg Kirby vulnerable to path traversal in the router for PHP's built-in server |
High EPSS 0.59% |
< 3.9.8.3 | 3.9.8.3 |
| GHSA-9p3p-w5jf-8xxg Kirby vulnerable to path traversal in the router for PHP's built-in server |
High EPSS 0.59% |
>= 3.10.0, < 3.10.1.2 | 3.10.1.2 |
| GHSA-9p3p-w5jf-8xxg Kirby vulnerable to path traversal in the router for PHP's built-in server |
High EPSS 0.59% |
>= 4.0.0, < 4.7.1 | 4.7.1 |
| GHSA-jm9m-rqr3-wfmh Kirby has insufficient permission checks in the language settings |
High EPSS 0.48% |
>= 3.7.0, < 3.7.5.5 | 3.7.5.5 |
| GHSA-jm9m-rqr3-wfmh Kirby has insufficient permission checks in the language settings |
High EPSS 0.48% |
< 3.6.6.6 | 3.6.6.6 |
| GHSA-jm9m-rqr3-wfmh Kirby has insufficient permission checks in the language settings |
High EPSS 0.48% |
>= 4.0.0, < 4.3.1 | 4.3.1 |
| GHSA-jm9m-rqr3-wfmh Kirby has insufficient permission checks in the language settings |
High EPSS 0.48% |
>= 3.9.0, < 3.9.8.2 | 3.9.8.2 |
| GHSA-jm9m-rqr3-wfmh Kirby has insufficient permission checks in the language settings |
High EPSS 0.48% |
>= 3.8.0, < 3.8.4.4 | 3.8.4.4 |
| GHSA-jm9m-rqr3-wfmh Kirby has insufficient permission checks in the language settings |
High EPSS 0.48% |
>= 3.10.0, < 3.10.1.1 | 3.10.1.1 |
| GHSA-63h4-w25c-3qv4 Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type |
Medium EPSS 0.35% |
>= 4.0.0, < 4.1.1 | 4.1.1 |
| GHSA-w879-mxj5-c3wf Duplicate Advisory: Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field Withdrawn |
Medium | < 4.1.1 | 4.1.1 |
| GHSA-fr72-9665-w3gr Duplicate Advisory: Unrestricted file upload of user avatar images Withdrawn |
Medium | < 4.1.1 | 4.1.1 |
| GHSA-xrvh-rvc4-5m43 Kirby vulnerable to unrestricted file upload of user avatar images |
High EPSS 0.97% |
>= 3.9.0, < 3.9.8.1 | 3.9.8.1 |
| GHSA-xrvh-rvc4-5m43 Kirby vulnerable to unrestricted file upload of user avatar images |
High EPSS 0.97% |
< 3.6.6.5 | 3.6.6.5 |
| GHSA-xrvh-rvc4-5m43 Kirby vulnerable to unrestricted file upload of user avatar images |
High EPSS 0.97% |
>= 3.7.0, < 3.7.5.4 | 3.7.5.4 |
| GHSA-xrvh-rvc4-5m43 Kirby vulnerable to unrestricted file upload of user avatar images |
High EPSS 0.97% |
>= 3.8.0, < 3.8.4.3 | 3.8.4.3 |
| GHSA-xrvh-rvc4-5m43 Kirby vulnerable to unrestricted file upload of user avatar images |
High EPSS 0.97% |
>= 3.10.0, < 3.10.0.1 | 3.10.0.1 |
| GHSA-xrvh-rvc4-5m43 Kirby vulnerable to unrestricted file upload of user avatar images |
High EPSS 0.97% |
>= 4.0.0, < 4.1.1 | 4.1.1 |
| GHSA-qv4x-v2v4-f8p9 Withdrawn Advisory: Kirby CMS HTML injection vulnerability Withdrawn |
High EPSS 0.32% |
<= 4.1.0 | No fix yet |
| GHSA-57f2-8p89-66x6 Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field |
Medium EPSS 0.40% |
>= 3.8.0, < 3.8.4.3 | 3.8.4.3 |
| GHSA-57f2-8p89-66x6 Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field |
Medium EPSS 0.40% |
< 3.6.6.5 | 3.6.6.5 |
| GHSA-57f2-8p89-66x6 Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field |
Medium EPSS 0.40% |
>= 3.10.0, < 3.10.0.1 | 3.10.0.1 |
| GHSA-57f2-8p89-66x6 Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field |
Medium EPSS 0.40% |
>= 4.0.0, < 4.1.1 | 4.1.1 |
| GHSA-57f2-8p89-66x6 Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field |
Medium EPSS 0.40% |
>= 3.9.0, < 3.9.8.1 | 3.9.8.1 |
| GHSA-57f2-8p89-66x6 Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field |
Medium EPSS 0.40% |
>= 3.7.0, < 3.7.5.4 | 3.7.5.4 |
| GHSA-3v6j-v3qc-cxff Denial of service from unlimited password lengths |
High EPSS 1.18% |
< 3.5.8.3 | 3.5.8.3 |
| GHSA-3v6j-v3qc-cxff Denial of service from unlimited password lengths |
High EPSS 1.18% |
>= 3.6.0, < 3.6.6.3 | 3.6.6.3 |
| GHSA-3v6j-v3qc-cxff Denial of service from unlimited password lengths |
High EPSS 1.18% |
>= 3.7.0, < 3.7.5.2 | 3.7.5.2 |
| GHSA-3v6j-v3qc-cxff Denial of service from unlimited password lengths |
High EPSS 1.18% |
>= 3.8.0, < 3.8.4.1 | 3.8.4.1 |
| GHSA-3v6j-v3qc-cxff Denial of service from unlimited password lengths |
High EPSS 1.18% |
>= 3.9.0, < 3.9.6 | 3.9.6 |
| GHSA-8fv7-wq38-f5c9 Cross-site scripting (XSS) from MIME type auto-detection of uploaded files |
Medium EPSS 0.62% |
>= 3.6.0, < 3.6.6.3 | 3.6.6.3 |
| GHSA-8fv7-wq38-f5c9 Cross-site scripting (XSS) from MIME type auto-detection of uploaded files |
Medium EPSS 0.62% |
>= 3.9.0, < 3.9.6 | 3.9.6 |
| GHSA-8fv7-wq38-f5c9 Cross-site scripting (XSS) from MIME type auto-detection of uploaded files |
Medium EPSS 0.62% |
>= 3.8.0, < 3.8.4.1 | 3.8.4.1 |
| GHSA-8fv7-wq38-f5c9 Cross-site scripting (XSS) from MIME type auto-detection of uploaded files |
Medium EPSS 0.62% |
>= 3.7.0, < 3.7.5.2 | 3.7.5.2 |
| GHSA-8fv7-wq38-f5c9 Cross-site scripting (XSS) from MIME type auto-detection of uploaded files |
Medium EPSS 0.62% |
< 3.5.8.3 | 3.5.8.3 |
| GHSA-q386-w6fg-gmgp XML External Entity (XXE) vulnerability in the XML data handler |
Critical EPSS 1.70% |
>= 3.9.0, < 3.9.6 | 3.9.6 |
| GHSA-q386-w6fg-gmgp XML External Entity (XXE) vulnerability in the XML data handler |
Critical EPSS 1.70% |
< 3.5.8.3 | 3.5.8.3 |
| GHSA-q386-w6fg-gmgp XML External Entity (XXE) vulnerability in the XML data handler |
Critical EPSS 1.70% |
>= 3.6.0, < 3.6.6.3 | 3.6.6.3 |
| GHSA-q386-w6fg-gmgp XML External Entity (XXE) vulnerability in the XML data handler |
Critical EPSS 1.70% |
>= 3.7.0, < 3.7.5.2 | 3.7.5.2 |
| GHSA-q386-w6fg-gmgp XML External Entity (XXE) vulnerability in the XML data handler |
Critical EPSS 1.70% |
>= 3.8.0, < 3.8.4.1 | 3.8.4.1 |
| GHSA-5mvj-rvp8-rf45 Insufficient Session Expiration after a password change |
High EPSS 0.81% |
< 3.5.8.3 | 3.5.8.3 |
| GHSA-5mvj-rvp8-rf45 Insufficient Session Expiration after a password change |
High EPSS 0.81% |
>= 3.9.0, < 3.9.6 | 3.9.6 |
| GHSA-5mvj-rvp8-rf45 Insufficient Session Expiration after a password change |
High EPSS 0.81% |
>= 3.8.0, < 3.8.4.1 | 3.8.4.1 |
| GHSA-5mvj-rvp8-rf45 Insufficient Session Expiration after a password change |
High EPSS 0.81% |
>= 3.7.0, < 3.7.5.2 | 3.7.5.2 |
| GHSA-5mvj-rvp8-rf45 Insufficient Session Expiration after a password change |
High EPSS 0.81% |
>= 3.6.0, < 3.6.6.3 | 3.6.6.3 |
| GHSA-x5mr-p6v4-wp93 Field injection in the KirbyData text storage handler |
High EPSS 0.92% |
>= 3.8.0, < 3.8.4.1 | 3.8.4.1 |
| GHSA-x5mr-p6v4-wp93 Field injection in the KirbyData text storage handler |
High EPSS 0.92% |
< 3.5.8.3 | 3.5.8.3 |
| GHSA-x5mr-p6v4-wp93 Field injection in the KirbyData text storage handler |
High EPSS 0.92% |
>= 3.6.0, < 3.6.6.3 | 3.6.6.3 |
| GHSA-x5mr-p6v4-wp93 Field injection in the KirbyData text storage handler |
High EPSS 0.92% |
>= 3.7.0, < 3.7.5.2 | 3.7.5.2 |
| GHSA-x5mr-p6v4-wp93 Field injection in the KirbyData text storage handler |
High EPSS 0.92% |
>= 3.9.0, < 3.9.6 | 3.9.6 |
| GHSA-c27j-76xg-6x4f Kirby CMS vulnerable to user enumeration in the brute force protection |
Medium EPSS 0.79% |
>= 3.6.0, < 3.6.6.2 | 3.6.6.2 |
| GHSA-c27j-76xg-6x4f Kirby CMS vulnerable to user enumeration in the brute force protection |
Medium EPSS 0.79% |
>= 3.8.0, < 3.8.1 | 3.8.1 |
| GHSA-c27j-76xg-6x4f Kirby CMS vulnerable to user enumeration in the brute force protection |
Medium EPSS 0.79% |
>= 3.7.0, < 3.7.5.1 | 3.7.5.1 |
| GHSA-c27j-76xg-6x4f Kirby CMS vulnerable to user enumeration in the brute force protection |
Medium EPSS 0.79% |
< 3.5.8.2 | 3.5.8.2 |
| GHSA-43qq-qw4x-28f8 Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms |
Medium EPSS 0.43% |
>= 3.5.0, < 3.5.8.2 | 3.5.8.2 |
| GHSA-43qq-qw4x-28f8 Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms |
Medium EPSS 0.43% |
>= 3.6.0, < 3.6.6.2 | 3.6.6.2 |
| GHSA-43qq-qw4x-28f8 Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms |
Medium EPSS 0.43% |
>= 3.7.0, < 3.7.5.1 | 3.7.5.1 |
| GHSA-43qq-qw4x-28f8 Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms |
Medium EPSS 0.43% |
>= 3.8.0, < 3.8.1 | 3.8.1 |
| GHSA-rv3r-vqjj-8c76 Cross-site scripting from content entered in the tags and multiselect fields |
High | >= 3.5.7, < 3.5.8.1 | 3.5.8.1 |
| GHSA-rv3r-vqjj-8c76 Cross-site scripting from content entered in the tags and multiselect fields |
High | >= 3.6.0, < 3.6.6.1 | 3.6.6.1 |
| GHSA-rv3r-vqjj-8c76 Cross-site scripting from content entered in the tags and multiselect fields |
High | >= 3.7.0, < 3.7.4 | 3.7.4 |
| GHSA-3f89-869f-5w76 Cross-site scripting from dynamic options in the multiselect field |
Medium EPSS 0.92% |
< 3.5.8.1 | 3.5.8.1 |
| GHSA-h3w2-qg2r-c7mf Kirby CMS 2.5.12 Cross-site Scripting |
Medium EPSS 0.71% |
<= 2.5.12 | No fix yet |
| GHSA-c7x2-7h8r-jq4m Kirby CMS 2.5.12 Cross-site Request Forgery |
Medium EPSS 0.50% |
<= 2.5.12 | No fix yet |
| GHSA-275c-v3rc-xghx Kirby XSS Vulnerability |
Medium EPSS 2.42% |
>= 2.4, < 2.4.2 | 2.4.2 |
| GHSA-275c-v3rc-xghx Kirby XSS Vulnerability |
Medium EPSS 2.42% |
< 2.3.3 | 2.3.3 |
| GHSA-275c-v3rc-xghx Kirby XSS Vulnerability |
Medium EPSS 2.42% |
>= 2.5, < 2.5.7 | 2.5.7 |
| GHSA-cq58-r77c-5jjw Cross-site scripting (XSS) from image block content in the site frontend |
Medium EPSS 0.81% |
>= 3.5.0, < 3.5.8 | 3.5.8 |
| GHSA-x7j7-qp7j-hw3q Cross-site scripting (XSS) from writer field content in the site frontend |
Medium EPSS 0.93% |
>= 3.5.0, < 3.5.8 | 3.5.8 |
| GHSA-2f2w-349x-vrqm Cross-site scripting (XSS) from field and configuration text displayed in the Panel |
High EPSS 0.53% |
< 3.5.7 | 3.5.7 |
| GHSA-qgp4-5qx6-548g Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby |
High EPSS 3.17% |
< 3.5.4 | 3.5.4 |
| GHSA-2ccx-2gf3-8xvv Kirby .dev domains and some reverse proxy setups were treated as local |
Medium EPSS 0.57% |
>= 3.0.0, < 3.3.6 | 3.3.6 |
| GHSA-g3h8-cg9x-47qw Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5 |
Medium EPSS 1.49% |
>= 3.0.0, < 3.4.5 | 3.4.5 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor