Panel
by Getkirby
Source repositories
CVEs (6)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2018-16627 | Med | 0.40 | 6.1 | 0.01 | Dec 20, 2018 | panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature. | ||
| CVE-2017-16807 | Med | 0.38 | 5.4 | 0.02 | Nov 13, 2017 | A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file. | ||
| CVE-2020-26255 | Med | 0.37 | 6.8 | 0.01 | Dec 8, 2020 | Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers… | ||
| CVE-2020-26253 | Med | 0.37 | 6.8 | 0.01 | Dec 8, 2020 | Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin… | ||
| CVE-2018-16628 | Med | 0.35 | 5.4 | 0.01 | Dec 4, 2018 | panel/login in Kirby v2.5.12 allows XSS via a blog name. | ||
| CVE-2018-16630 | Med | 0.31 | 4.8 | 0.01 | Dec 28, 2018 | Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file. |
- risk 0.40cvss 6.1epss 0.01
panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.
- risk 0.38cvss 5.4epss 0.02
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
- risk 0.37cvss 6.8epss 0.01
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers…
- risk 0.37cvss 6.8epss 0.01
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin…
- risk 0.35cvss 5.4epss 0.01
panel/login in Kirby v2.5.12 allows XSS via a blog name.
- risk 0.31cvss 4.8epss 0.01
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.