Executive brief
No protection against brute-force attacks on login page
Affected products
- PyPI kiwitcms
Junglewise Threat Intelligence
CVE-2023-25156: PYSEC-2026-835 - No protection against brute-force attacks on login page
CVE-2023-25156 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: kiwitcms (PyPI). Vendors: PyPI.
Related threats
- Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/vie
- Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user inp
- Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter
- PYSEC-2026-1499 - Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
- PYSEC-2026-1495 - kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload