Kirby CMS 2.5.12 Cross-site Scripting

MEDIUM 5.4CVE-2018-14520 · GHSA-h3w2-qg2r-c7mf · Published 24/08/2022 · updated 17/06/2026

In short

CVE-2018-14520 is a MEDIUM (CVSS 5.4) vulnerability affecting getkirby/cms, kirby (getkirby).
Chance of exploitation in the next 30 days (EPSS): 0.71%, higher than 53.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
getkirby/cms Packagist	`≤ 2.5.12`	No fix yet
kirby getkirby	`= 2.5.12`	No fix yet

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.

NVD description

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≤ 2.5.12

No fix yet

= 2.5.12

No fix yet

Description

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.

NVD description

An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages.

More vulnerabilities in getkirby/cms

See all →