PYSEC-2026-837

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/kiwitcms/PYSEC-2026-837.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-837

Aliases

Published

2026-07-07T10:17:24.264045Z

Modified

2026-07-07T11:46:04.799584455Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-site Scripting in kiwitcms

Details

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.

References

Affected packages

PyPI / kiwitcms

Package

Name: kiwitcms; View open source insights on deps.dev
Purl: pkg:pypi/kiwitcms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

11.6

Affected versions

6.*

6.2.1

6.3

6.4

6.5

6.5.3

6.6

6.7

6.8

6.9

6.10

6.11

7.*

7.0

7.1

7.2

7.2.1

7.3

8.*

8.0

8.1

8.1.99

8.2

8.3

8.4

8.5

8.6

8.6.1

8.7

8.8

8.9

9.*

9.0

9.999

10.*

10.0

10.1

10.2

10.3

10.3.999

10.4

10.5

11.*

11.0

11.1

11.3

11.4

11.5

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/kiwitcms/PYSEC-2026-837.yaml"