Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 51
Reset filtersKirby is missing permission checks in the content changes API
Kirby CMS has cross-site scripting (XSS) in the changes dialog
Kirby vulnerable to path traversal in the router for PHP's built-in server
Kirby vulnerable to path traversal of collection names during file system lookup
Kirby has insufficient permission checks in the language settings
Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type
Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field
Kirby vulnerable to unrestricted file upload of user avatar images
Field injection in the KirbyData text storage handler
Insufficient Session Expiration after a password change
XML External Entity (XXE) vulnerability in the XML data handler
Cross-site scripting (XSS) from MIME type auto-detection of uploaded files
Denial of service from unlimited password lengths
Kirby CMS vulnerable to user enumeration in the brute force protection
Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms
Cross-site scripting from content entered in the tags and multiselect fields
Cross-site scripting from dynamic options in the multiselect field
Kirby CMS 2.5.12 Cross-site Scripting
Kirby CMS 2.5.12 Cross-site Request Forgery
Kirby XSS Vulnerability
Cross-site scripting (XSS) from image block content in the site frontend
Cross-site scripting (XSS) from writer field content in the site frontend
Cross-site scripting (XSS) from field and configuration text displayed in the Panel
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.