Medium severity5.4NVD Advisory· Published Nov 21, 2022· Updated Jun 17, 2026

CVE-2022-4105

Description

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
kiwitcmsPyPI	< 11.6	11.6

Affected products

Kiwitcms/Kiwi Tcms2 versions
cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:kiwitcms:kiwi_tcms:*:*:*:*:*:*:*:*range: <11.6
- (no CPE)range: unspecified
ghsa-coords
pkg:pypi/kiwitcms
Range: < 11.6

Patches

Vulnerability mechanics

References

github.com/kiwitcms/kiwi/commit/a2b169ffdef1d7c1755bade8138578423b35011bnvdPatchThird Party AdvisoryWEB
huntr.dev/bounties/386417e9-0cd5-4d80-8137-b0fd5c30b8f8nvdExploitIssue TrackingPatchThird Party AdvisoryWEB
github.com/advisories/GHSA-hf94-8mx5-2vvjghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-4105ghsaADVISORY

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000