| Package | Affected versions | Patched versions |
|---|---|---|
| kiwitcms | < 11.6 | 11.6 |
| kiwi tcms | < 11.6 | 11.6 |
A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free