A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
CVSS 2.0
Severity: LOW
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| getkirby | panel | * |
Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.
CVSS 2.0
Severity: LOW
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| getkirby | kirby | 2.5.12 |
panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.
CVSS 2.0
Severity: LOW
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| getkirby | kirby | 2.5.12 |
panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-74,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| getkirby | kirby | 2.5.12 |
panel/login in Kirby v2.5.12 allows XSS via a blog name.
CVSS 2.0
Severity: LOW
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| getkirby | kirby | 2.5.12 |
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
CVSS 2.0
Severity: LOW
Problem Type: CWE-79,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| getkirby | kirby | 2.5.12 |