Getkirby ≫ Kirby

Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like `<script>` tags. The direct link to that file can be sent to other users or visitors of the site. If the victim open...

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you mi...

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public serv...

panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.

Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown.

Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.

panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature.

panel/login in Kirby v2.5.12 allows XSS via a blog name.