cve.bz

CVE-2023-25156

9.8 criticalEPSS 0.9%

Critical (9.8) in kiwitcms kiwi tcms. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in kiwitcms 12.0.

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWEs
CWE-307, CWE-770
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-7968-h4m4-ghm9PyPIkiwitcms<12.012.0
PYSEC-2026-835PyPIkiwitcms<12.012.0

References

Check your stackJSON