Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
64 results · page 2 of 2
Aug 18, 2022A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloadCVE-2022-35174 · Other software · Getkirby · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.
- Product
- Starterkit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Kirby is an open source file structured CMS.CVE-2021-41258 · Other software · getkirby · reported by GitHubHigh 7.3
Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special characters to protect against cross-site scripting (XSS) attacks. The default snippet for the image block unfortunately did not use our escaping helper. This made it possible to include malicious HTML code in the source, alt and link fields of the image block, which would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. Attackers must be in your group of authenticated Panel users in order to exploit this weakness. Users who do not make use of the blocks field are not affected. This issue has been patched in Kirby version 3.5.8 by escaping special HTML characters in the output from the default image block snippet. Please update to this or a later version to fix the vulnerability.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 16, 2021Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code.CVE-2021-41252 · Other software · getkirby · reported by GitHubHigh 7.3
Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not possible to escape HTML special characters against cross-site scripting (XSS) attacks, otherwise the formatting would be lost. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Because the writer field did not securely sanitize its contents on save, it was possible to inject malicious HTML code into the content file by sending it to Kirby's API directly without using the Panel. This malicious HTML code would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. Attackers must be in your group of authenticated Panel users in order to exploit this weakness. Users who do not make use of the writer field are not affected. This issue has been patched in Kirby 3.5.8 by sanitizing all writer field contents on the backend whenever the content is modified via Kirby's API. Please update to this or a later version to fix the vulnerability.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021Kirby is a content management system.CVE-2021-32735 · Other software · getkirby · reported by GitHubHigh 7.1
Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. Malicious authenticated Panel users can escalate their privileges if they get access to the Panel session of an admin user. Visitors without Panel access can use the attack vector if the site allows changing site data from a frontend form. Kirby 3.5.7 patches the vulnerability. As a partial workaround, site administrators can protect against attacks from visitors without Panel access by validating or sanitizing provided data from the frontend form.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2021Kirby is an open source CMS.CVE-2021-29460 · Other software · getkirby · reported by GitHubHigh 7.6
Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like `<script>` tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that link in a browser where they are logged in to Kirby, the script will run and can for example trigger requests to Kirby's API with the permissions of the victim. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible. Visitors without Panel access can only use this attack vector if your site allows SVG file uploads in frontend forms and you don't already sanitize uploaded SVG files. The problem has been patched in Kirby 3.5.4. Please update to this or a later version to fix the vulnerability. Frontend upload forms need to be patched separately depending on how they store the uploaded file(s). If you use `File::create()`, you are protected by updating to 3.5.4+. As a work around you can disable the upload of SVG
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 8, 2020Kirby is a CMS.CVE-2020-26255 · Other software · getkirby · reported by GitHubMedium 6.8
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 7, 2020Kirby is a CMS.CVE-2020-26253 · Other software · getkirby · reported by GitHubMedium 6.8
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget registering your first admin account on a public server. In this case – without our security block – someone else might theoretically be able to find your site, find out it's running on Kirby, find the Panel and then register the account first. It's an unlikely situation, but it's still a certain risk. To be able to register the first Panel account on a public server, you have to enforce the installer via a config setting. This helps to push all users to the best practice of registering your first Panel account on your local machine and upload it together with the rest of the site. This installation block implementation in Kirby versions before 3.3.6 still assumed that .dev domains are local domains, which is no longer true. In the
- Product
- kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2019panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.CVE-2018-16624 · Other software · Getkirby · reported by MITREMedium 5.4
panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.
- Product
- Kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2019Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.CVE-2018-16623 · Other software · Getkirby · reported by MITREMedium 4.8
Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.
- Product
- Kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2018Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.CVE-2018-16630 · Other software · Getkirby · reported by MITREMedium 4.8
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
- Product
- Kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2018panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.CVE-2018-16627 · Other software · Getkirby · reported by MITREMedium 6.1
panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.
- Product
- Kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2018panel/login in Kirby v2.5.12 allows XSS via a blog name.CVE-2018-16628 · Other software · Getkirby · reported by MITREMedium 5.4
panel/login in Kirby v2.5.12 allows XSS via a blog name.
- Product
- Kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2017A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SCVE-2017-16807 · Other software · Getkirby · reported by MITREMedium 5.4
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
- Product
- Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgetkirby.compacketstormsecurity.com
Nov 19, 2015Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP CVE-2015-7773 · Other software · Bastian Allgeier · reported by vultures@jpcert.or.jpMedium 6.5
Unrestricted file upload vulnerability in the Panel component in Bastian Allgeier Kirby before 2.1.2 allows remote authenticated users to execute arbitrary PHP code by uploading a file that lacks an extension, and then renaming this file to have a .php extension.
- Product
- Kirby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.