Executive brief
Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
Affected products
- PyPI kiwitcms
Junglewise Threat Intelligence
CVE-2023-36809: PYSEC-2026-1499 - Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox
CVE-2023-36809 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: kiwitcms (PyPI). Vendors: PyPI.
Related threats
- Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/vie
- Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user inp
- Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter
- PYSEC-2026-1495 - kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload
- PYSEC-2026-1500 - kiwitcms vulnerable to stored XSS via unrestricted files upload