alcali (>=2018.3.2, <=2019.2.2), botbuilder-applicationinsights (>=4.7.0, <=4.14.2) +4 more potentially affected by CVE-2025-48432 via django (2.2.6)

django PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.2, =4.7.0, =4.10.0, =4.14.2 - kiwitcms 7.1.0 - ls-orb 0.1.0 - wazimap 2.1.0 Source cves: CVE-2025-48432 Source advisory:...

django-email-testview (>=0.0.1, <=0.1.0), django-polls-tutorial-v (>=1.0.1, <=1.2.6) +4 more potentially affected by CVE-2025-48432 via django (2.2.2)

django PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-email-testview =0.0.1, =1.0.1, =0.1.0, =1.0.1, =21.4.0rc1, =21.4.0rc4 Source cves: CVE-2025-48432 Source advisory: OSV:GHSA-7XR5-9HCQ-CHF9...

django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2025-48432 via django (2.1.5)

django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2025-48432 Source advisory: OSV:GHSA-7XR5-9HCQ-CHF9...

django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2024-45231 via django (2.1.5)

django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

ashley (1.0.0b4), hazard-feed (>=0.2.0, <=0.2.5) +1 more potentially affected by CVE-2024-45231 via django (3.1.4)

django PYPI version 3.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ashley 1.0.0b4 - hazard-feed =0.2.0, =0.2.5 - kiwitcms 8.9.0 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

edc (>=0.1.47, <=0.1.72), kiwitcms (8.6.0) +3 more potentially affected by CVE-2024-45231 via django (3.0.9)

django PYPI version 3.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - edc =0.1.47, =0.0.1, =0.0.3 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

alcali (>=2018.3.2, <=2019.2.2), botbuilder-applicationinsights (>=4.7.0, <=4.14.2) +4 more potentially affected by CVE-2024-45231 via django (2.2.6)

django PYPI version 2.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2018.3.2, =4.7.0, =4.10.0, =4.14.2 - kiwitcms 7.1.0 - ls-orb 0.1.0 - wazimap 2.1.0 Source cves: CVE-2024-45231 Source advisory:...

django-bloggy (1.0.0), kiwitcms (10.5.0) +2 more potentially affected by CVE-2024-45231 via django (3.2.9)

django PYPI version 3.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-bloggy 1.0.0 - kiwitcms 10.5.0 - mercarigetter =1.0.14, =1.0.0, =1.1.0 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

kiwitcms (10.1.0), nobinobi-core (0.1.4.1) +5 more potentially affected by CVE-2024-45231 via django (3.2.3)

django PYPI version 3.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - kiwitcms 10.1.0 - nobinobi-core 0.1.4.1 - nobinobi-staff 0.1.6.1 - xdj-datamap =0.0.1, =0.0.1, =0.0.3, =0.0.1, =0.0.6 Source cves: CVE-2024-45231...

djangoappcenter (>=0.1.0, <=0.9.16), djangodjangoappcenter (0.0.11) +4 more potentially affected by CVE-2024-45231 via django (3.0.2)

django PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - djangoappcenter =0.1.0, =0.1.1, =0.0.2, =0.0.4 - medicine 0.1.9 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

django-filebrowser (3.13.2), geonode (3.3.3) +2 more potentially affected by CVE-2021-46898 via django-grappelli (>=2.10.1, <=2.15.1)

django-grappelli PYPI version =2.10.1, =6.5.0, =1.12.1, =1.13.0.dev10 Source cves: CVE-2021-46898 Source advisory: GHSA-9X43-5QCQ-H79Q...

django-filebrowser (3.13.2), geonode (3.3.3) +2 more potentially affected by CVE-2021-46898 via django-grappelli (>=2.10.1, <=2.15.1)

django-grappelli PYPI version =2.10.1, =6.5.0, =1.12.1, =1.13.0.dev10 Source cves: CVE-2021-46898 Source advisory: MEND:CVE-2021-46898...

Cross-Site Scripting (XSS)

kiwitcms is vulnerable to Cross-Site Scripting XSS. The vulnerability exists because some browser fail to prevent interpreting untrusted files which allows an attacker to inject and execute arbitrary JavaScript as tests...

Cross-Site Scripting (XSS)

kiwitcms is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to a lack of file content validation in the denyuploadscontainingscripttag function of validators.py, which allows an attacker to inject arbitrary JavaScript code into a victim's browser...

Cross-site Scripting (XSS)

kiwitcms is vulnerable to Cross-site Scripting XSS. The vulnerability exists because user uploaded files are not properly validated in certain circumstances which allows an attacker to inject and execute arbitrary JavaScript...

OS Command Injection

kiwitcms is vulnerable to OS Command Injection. The vulnerability exists because the github.headref key in changelog.yml does not properly check the workflow, which allows an attacker to gain write access to file configurations...

Incorrect Authorization

kiwitcms is vulnerable to Incorrect Authorization. The vulnerability exists in email parameter of admin.py because it does not properly validate email addresses in the admin page, which allows an attacker to change an email address without verifying ownership during account registration...

Arbitrary File Upload

kiwitcms is vulnerable to Arbitrary File Upload. The vulnerability exists because the library does not properly validate files uploaded, allowing an attacker to bypass the file upload restrictions by uploading a malicious .exe file or embedded JavaScript file, tricking people into clicking on the...

Stored XSS and CSP Bypass in KiwiTCMS

Description Stored XSS, also known as persistent XSS, is the more damaging of the XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Due to a sanitization problem it is possible to perform a Stored XSS. The problem is that the upload function permit...

CVE-2023-30628: Improper Neutralization of Special Elements used in an OS Command

Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the changelog.yml workflow is vulnerable to command injection attacks because of using an untrusted github.headref field. The github.headref value is an attacker-controlle...