Executive brief
kiwitcms vulnerable to stored XSS via unrestricted files upload
Affected products
- PyPI kiwitcms
Junglewise Threat Intelligence
CVE-2023-32686: PYSEC-2026-1500 - kiwitcms vulnerable to stored XSS via unrestricted files upload
CVE-2023-32686 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: kiwitcms (PyPI). Vendors: PyPI.
Related threats
- Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/vie
- Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user inp
- Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter
- PYSEC-2026-1499 - Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
- PYSEC-2026-1495 - kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload