[MEDIUM] Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field

PKSA-sz76-zpcd-hvzc CVE-2024-26481 GHSA-57f2-8p89-66x6

Affected version: >=4.0.0,<=4.1.0|=3.10.0|>=3.9.0,<=3.9.8|>=3.8.0,<=3.8.4.2|>=3.7.0,<=3.7.5.3|<=3.6.6.4

Reported by:
GitHub

[MEDIUM] Kirby vulnerable to unrestricted file upload of user avatar images

PKSA-yxtp-sp4n-y3tf CVE-2024-26483 GHSA-xrvh-rvc4-5m43

Affected version: >=4.0.0,<=4.1.0|=3.10.0|>=3.9.0,<=3.9.8|>=3.8.0,<=3.8.4.2|>=3.7.0,<=3.7.5.3|<=3.6.6.4

Reported by:
GitHub

[MEDIUM] Kirby CMS HTML injection vulnerability

PKSA-x371-65jb-pv6y CVE-2024-26482 GHSA-qv4x-v2v4-f8p9

Affected version: <=4.1.0

Reported by:
GitHub

[HIGH] Field injection in the KirbyData text storage handler

PKSA-zqxs-5pcg-2nkm CVE-2023-38488 GHSA-x5mr-p6v4-wp93

Affected version: >=3.9.0,<3.9.6|>=3.8.0,<3.8.4.1|>=3.7.0,<3.7.5.2|>=3.6.0,<3.6.6.3|<3.5.8.3

Reported by:
GitHub

[HIGH] Insufficient Session Expiration after a password change

PKSA-8t3n-wjby-x47v CVE-2023-38489 GHSA-5mvj-rvp8-rf45

Affected version: >=3.9.0,<3.9.6|>=3.8.0,<3.8.4.1|>=3.7.0,<3.7.5.2|>=3.6.0,<3.6.6.3|<3.5.8.3

Reported by:
GitHub

[MEDIUM] XML External Entity (XXE) vulnerability in the XML data handler

PKSA-t9s4-yst7-6h1r CVE-2023-38490 GHSA-q386-w6fg-gmgp

Affected version: >=3.9.0,<3.9.6|>=3.8.0,<3.8.4.1|>=3.7.0,<3.7.5.2|>=3.6.0,<3.6.6.3|<3.5.8.3

Reported by:
GitHub

[MEDIUM] Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

PKSA-dkbm-bh96-zk72 CVE-2023-38491 GHSA-8fv7-wq38-f5c9

Affected version: >=3.9.0,<3.9.6|>=3.8.0,<3.8.4.1|>=3.7.0,<3.7.5.2|>=3.6.0,<3.6.6.3|<3.5.8.3

Reported by:
GitHub

[MEDIUM] Denial of service from unlimited password lengths

PKSA-3nsf-jngg-dvvg CVE-2023-38492 GHSA-3v6j-v3qc-cxff

Affected version: >=3.9.0,<3.9.6|>=3.8.0,<3.8.4.1|>=3.7.0,<3.7.5.2|>=3.6.0,<3.6.6.3|<3.5.8.3

Reported by:
GitHub