{"action":"Upgrade kiwitcms to 12.5 or later.","affected":[{"fixed":"12.5","introduced":"0"}],"component":"kiwitcms","cve_ids":["CVE-2023-36809"],"ecosystem":"PyPI","epss":0.00692,"exploited":false,"fixed_versions":["12.5"],"ghsa_id":"GHSA-jpgw-2r9m-8qfw","id":"tcs_01M5KFPAVQYCE6XVAHV6DTJV2W","modified_at":"2026-07-07T17:56:37.771952404Z","published_at":"2023-07-05T22:40:59Z","references":["https://osv.dev/vulnerability/GHSA-jpgw-2r9m-8qfw","https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-jpgw-2r9m-8qfw","https://nvd.nist.gov/vuln/detail/CVE-2023-36809","https://github.com/kiwitcms/kiwi/commit/195ea53eaaf360c19227c864cc0fe58910032c3c","https://github.com/kiwitcms/kiwi/commit/ffb00450be52fe11a82a2507632c2328cae4ec9d","https://github.com/kiwitcms/Kiwi","https://huntr.dev/bounties/511489dd-ba38-4806-9029-b28ab2830aa8","https://huntr.dev/bounties/c6eeb346-fa99-4d41-bc40-b68f8d689223","https://kiwitcms.org/blog/kiwi-tcms-team/2023/07/04/kiwi-tcms-125","https://www.github.com/kiwitcms/kiwi/commit/195ea53eaaf360c19227c864cc0fe58910032c3c","https://www.github.com/kiwitcms/kiwi/commit/ffb00450be52fe11a82a2507632c2328cae4ec9d"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-jpgw-2r9m-8qfw","url":"https://osv.dev/vulnerability/GHSA-jpgw-2r9m-8qfw"}],"summary":"Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox"}