CVE-2026-54724: fallo de gravedad media en kiwitcms Kiwi
Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.1epss 0.3%
Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Productos afectados
kiwitcms · KiwiCVEs relacionadas — kiwitcms Kiwi
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-30628HIGHKiwi TCMS has command injection vulnerability in changelog.yml CI workflowEPSS 3.6%CVE-2023-30613HIGHKiwi TCMS unrestricted file upload vulnerabilityEPSS 1.0%CVE-2023-33977HIGHStored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMSEPSS 0.9%CVE-2023-22451MEDIUMWeak password requirements in Kiwi TCMSEPSS 0.7%CVE-2023-36809HIGHKiwi TCMS's misconfigured HTTP headers allow stored XSS execution with FirefoxEPSS 0.7%CVE-2023-27489HIGHStored cross site scripting via SVG file upload in Kiwi TCMSEPSS 0.5%