16 matches found
CVE-2026-55630 Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extralink and TestPlan.extralink accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a...
CVE-2026-55630 Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)
Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extralink and TestPlan.extralink accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a...
Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
SummaryIn Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...
Kiwi TCMS vulnerable to stored XSS via JavaScript: URI in extra_link field (TestPlan & TestCase)
Summary In Kiwi TCMS the fields TestCase.extralink and TestPlan.extralink were meant to represent URLs to external resources however in versions prior to 16.1 user input was not being sanitized and values were rendered verbatim which represents an opportunity for cross-site scripting exploitation...
PT-2026-56086
Name of the Vulnerable Software and Affected Versions Kiwi TCMS versions prior to 16.1 Description User input in the TestCase.extra link and TestPlan.extra link fields is not sanitized and is rendered verbatim, allowing for cross-site scripting XSS, a technique where malicious scripts are injecte...
CVE-2024-46097
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplanid parameter to another ID. The application does not carry out a...
CVE-2024-46097
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplanid parameter to another ID. The application does not carry out a...
CVE-2024-46097
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplanid parameter to another ID. The application does not carry out a...
CVE-2024-46097
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplanid parameter to another ID. The application does not carry out a...
CVE-2024-46097
TestLink version 1.9.20 is vulnerable to Incorrect Access Control within the TestPlan editing section . The application automatically generates IDs with incremental values for new TestPlans. By using the edit function, an attacker can modify the tplan_id parameter to target other IDs. Because the...
CVE-2024-46097
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplanid parameter to another ID. The application does not carry out a...
PT-2024-31908 · Testlink · Testlink
Name of the Vulnerable Software and Affected Versions: TestLink version 1.9.20 Description: The issue is related to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function, it is...
CVE-2024-46097: Improper Access Control
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplanid parameter to another ID. The application does not carry out a...
CVE-2008-5807
Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via 1 Testproject Names and 2 Testplan Names in planEdit.php, and possibly 3 Testcaseprefixes in projectview.tpl...
CVE-2008-5807
Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via 1 Testproject Names and 2 Testplan Names in planEdit.php, and possibly 3 Testcaseprefixes in projectview.tpl...
CVE-2008-5807: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in TestLink before 1.8 RC1 allow remote attackers to inject arbitrary web script or HTML via 1 Testproject Names and 2 Testplan Names in planEdit.php, and possibly 3 Testcaseprefixes in projectview.tpl...