Most recent entries from all

EUVD-2026-221563

2026-10-03T17:55:05.668118+00:00

EUVD-2026-221563

fkie_cve-2023-25156

2026-10-03T17:55:05.668164+00:00

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

GHSA-7968-h4m4-ghm9 — No protection against brute-force attacks on login page

2026-10-03T17:55:05.668200+00:00

Affected: PyPI: kiwitcms

### Impact Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.

### Patches Users should upgrade to v12.0 or later.

### Workarounds Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.

### References [Disclosed by spyata](https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/)

gsd-2023-25156

2026-10-03T17:55:05.668230+00:00