CVE-2023-25156

Kiwi TCMS, an open source test management system, does not impose rate limits in versions prior to 12.0. This makes it easier to attempt brute-force attacks against the login page. Users should upgrade to v12.0 or later to receive a patch. As a workaround, users may install and configure a rate-limiting proxy in front of Kiwi TCMS.

• CWE-770
• CWE-307

• https://github.com/kiwitcms/Kiwi/commit/0ed213fa0ddb7a6dc77e3c3b99e8fc90ccdaf46fPatch
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7968-h4m4-ghm9Vendor Advisory
• https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/Permissions Required
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120/Release Notes
• https://github.com/kiwitcms/Kiwi/commit/0ed213fa0ddb7a6dc77e3c3b99e8fc90ccdaf46fPatch
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7968-h4m4-ghm9Vendor Advisory
• https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/Permissions Required
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/02/15/kiwi-tcms-120/Release Notes

Published

Feb 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-25150Nextcloud office/richdocuments is an office suit for the nex…5.7
• CVE-2023-25151opentelemetry-go-contrib is a collection of extensions for O…7.5
• CVE-2023-25152Wings is Pterodactyl's server control plane. Affected versio…8.8
• CVE-2023-25153containerd is an open source container runtime. Before versi…5.5
• CVE-2023-25154Misskey is an open source, decentralized social media platfo…6.1
• CVE-2023-25155Redis is an in-memory database that persists on disk. Authen…6.5
• CVE-2023-25157GeoServer is an open source software server written in Java …9.8
• CVE-2023-25158GeoTools is an open source Java library that provides tools …9.8
• CVE-2023-25159Nextcloud Server is the file server software for Nextcloud, …5.3
• CVE-2023-2516Cross-site Scripting (XSS) - Stored in GitHub repository nil…5.4
• CVE-2023-25160Nextcloud Mail is an email app for the Nextcloud home server…5.3
• CVE-2023-25161Nextcloud Server is the file server software for Nextcloud, …5.3