Security Advisories for getkirby/cms in packagist
Low
6 months ago
Kirby vulnerable to path traversal in the router for PHP's built-in server
packagist
getkirby/cms
Moderate
6 months ago
Kirby vulnerable to path traversal of collection names during file system lookup
packagist
getkirby/cms
High
about 1 year ago
Kirby has insufficient permission checks in the language settings
packagist
getkirby/cms
Moderate
over 1 year ago
Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type
packagist
getkirby/cms
Moderate
over 1 year ago
Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field
packagist
getkirby/cms
Moderate
over 1 year ago
Kirby vulnerable to unrestricted file upload of user avatar images
packagist
getkirby/cms
High
over 2 years ago
Insufficient Session Expiration after a password change
packagist
getkirby/cms
Moderate
over 2 years ago
XML External Entity (XXE) vulnerability in the XML data handler
packagist
getkirby/cms
Moderate
over 2 years ago
Cross-site scripting (XSS) from MIME type auto-detection of uploaded files
packagist
getkirby/cms
Moderate
about 3 years ago
Kirby CMS vulnerable to user enumeration in the brute force protection
packagist
getkirby/cms
Moderate
about 3 years ago
Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms
packagist
getkirby/cms
High
about 3 years ago
Cross-site scripting from content entered in the tags and multiselect fields
packagist
getkirby/cms
Moderate
about 3 years ago
Cross-site scripting from dynamic options in the multiselect field
packagist
getkirby/cms
Moderate
almost 4 years ago
Cross-site scripting (XSS) from image block content in the site frontend
packagist
getkirby/cms
Moderate
almost 4 years ago
Cross-site scripting (XSS) from writer field content in the site frontend
packagist
getkirby/cms
High
over 4 years ago
Cross-site scripting (XSS) from field and configuration text displayed in the Panel
packagist
getkirby/cms
High
over 4 years ago
Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby
packagist
getkirby/cms
Moderate
almost 5 years ago
Kirby .dev domains and some reverse proxy setups were treated as local
packagist
getkirby/cms, getkirby/panel
Moderate
almost 5 years ago
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5
packagist
getkirby/cms, getkirby/panel