CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41258 – Cross-site scripting (XSS) from image block content in the site frontend
https://notcve.org/view.php?id=CVE-2021-41258
Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block snippets to convert the blocks to HTML for use in your templates. We recommend to escape HTML special characters to protect against cross-site scripting (XSS) attacks. The default snippet for the image block unfortunately did not use our escaping helper. • https://github.com/getkirby/kirby/pull/3510 https://github.com/getkirby/kirby/releases/tag/3.5.8 https://github.com/getkirby/kirby/security/advisories/GHSA-cq58-r77c-5jjw • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-41252 – Cross-site scripting (XSS) from writer field content in the site frontend
https://notcve.org/view.php?id=CVE-2021-41252
Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not possible to escape HTML special characters against cross-site scripting (XSS) attacks, otherwise the formatting would be lost. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Because the writer field did not securely sanitize its contents on save, it was possible to inject malicious HTML code into the content file by sending it to Kirby's API directly without using the Panel. This malicious HTML code would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site. • https://github.com/getkirby/kirby/commit/25fc5c6b330442e6433c99befc688f3698c5d1fc https://github.com/getkirby/kirby/releases/tag/3.5.8 https://github.com/getkirby/kirby/security/advisories/GHSA-x7j7-qp7j-hw3q • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-32735 – Cross-site scripting (XSS) from field and configuration text displayed in the Panel
https://notcve.org/view.php?id=CVE-2021-32735
Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example) displayed HTML in page titles as it is. This could be used for cross-site scripting (XSS) attacks. Malicious authenticated Panel users can escalate their privileges if they get access to the Panel session of an admin user. Visitors without Panel access can use the attack vector if the site allows changing site data from a frontend form. • https://github.com/getkirby/kirby/releases/tag/3.5.7 https://github.com/getkirby/kirby/security/advisories/GHSA-2f2w-349x-vrqm • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 7.6EPSS: 1%CPEs: 1EXPL: 3CVE-2021-29460 – Cross-site scripting (XSS) from unsanitized uploaded SVG files
https://notcve.org/view.php?id=CVE-2021-29460
Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like `<script>` tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that link in a browser where they are logged in to Kirby, the script will run and can for example trigger requests to Kirby's API with the permissions of the victim. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can escalate their privileges if they get access to the Panel session of an admin user. • https://www.exploit-db.com/exploits/49808 http://packetstormsecurity.com/files/162359/Kirby-CMS-3.5.3.1-Cross-Site-Scripting.html https://github.com/getkirby/kirby/releases/tag/3.5.4 https://github.com/getkirby/kirby/security/advisories/GHSA-qgp4-5qx6-548g • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-26255 – PHP Phar archives could be uploaded and executed in Kirby
https://notcve.org/view.php?id=CVE-2020-26255
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. • https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881 https://github.com/getkirby/kirby/commit/db8f371b13036861c9cc5ba3e85e27f73fce5e09 https://github.com/getkirby/kirby/releases/tag/3.4.5 https://github.com/getkirby/kirby/security/advisories/GHSA-g3h8-cg9x-47qw https://packagist.org/packages/getkirby/cms https://packagist.org/packages/getkirby/panel • CWE-434: Unrestricted Upload of File with Dangerous Type •