CVE-2023-30544

Kiwi TCMS is an open source test management system. In versions of Kiwi TCMS prior to 12.2, users were able to update their email addresses via the `My profile` admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration. Operators of Kiwi TCMS should upgrade to v12.2 or later to receive a patch. No known workarounds exist.

• CWE-283
• CWE-863
• CWE-863

• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjgVendor Advisory
• https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/Permissions Required
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/Release Notes
• https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-7x6q-3v3m-cwjgVendor Advisory
• https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/Permissions Required
• https://kiwitcms.org/blog/kiwi-tcms-team/2023/04/23/kiwi-tcms-122/Release Notes
• https://huntr.com/bounties/1714df73-e639-4d64-ab25-ced82dad9f85

Published

Apr 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30538Discourse is an open source platform for community discussio…5.4
• CVE-2023-30539Nextcloud is a personal home server system. Depending on the…8.8
• CVE-2023-30540Nextcloud Talk is a chat, video & audio call extension for N…4.3
• CVE-2023-30541OpenZeppelin Contracts is a library for secure smart contrac…5.3
• CVE-2023-30542OpenZeppelin Contracts is a library for secure smart contrac…8.8
• CVE-2023-30543@web3-react is a framework for building Ethereum Apps . In a…5.7
• CVE-2023-30545PrestaShop is an Open Source e-commerce web application. Pri…6.5
• CVE-2023-30546Contiki-NG is an operating system for Internet of Things dev…7.5
• CVE-2023-30547vm2 is a sandbox that can run untrusted code with whiteliste…10
• CVE-2023-30548gatsby-plugin-sharp is a plugin for the gatsby framework whi…4.3
• CVE-2023-30549Apptainer is an open source container platform for Linux. Th…7.8
• CVE-2023-3055The Page Builder by AZEXO plugin for WordPress is vulnerable…4.3