CVE-2022-4105: Kiwitcms Kiwi Tcms

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) and an HTML injection which disables the use of the history page.

Affected products

• Kiwitcms Kiwi Tcms: before 11.6 (fixed in 11.6)

Published 2022-11-21. Last modified 2026-06-17.