← ターゲット選定に戻る

CMS

getkirby/kirby

Kirby's core application folder

#kirby#cms#content-management#cms-framework#file-based#php8#flat-file#flat-file-cms#headless-cms

スコア

90

/ 100

Star

1,500

Fork

186

Open Issue

122

サイズ

59MB

言語

PHP ★

最終push

0 日前

Docker

—

採点内訳

過去CVE 20件 (やや多い)

✓

直近 push: 0 日前

✓

得意言語 (PHP)

✓

オープンissue 122件

✓

中規模 (59MB)

✓

Docker 未対応

—

1k–10k: 初心者ベスト (★1,500)

✓

※ 各項目の重みは「採点ルール」を参照。合計は 0 で底打ち。

過去の SecurityAdvisory (20 件)

MEDIUMGHSA-x68m-c7jf-2572 CVE-2026-420512026/4/23
System API endpoint leaks installed version and license data to authenticated users
MEDIUMGHSA-w942-j9r6-hr6r CVE-2026-400992026/4/23
Page creation API bypasses `changeStatus` permission check via unfiltered `isDraft` parameter
MEDIUMGHSA-39cp-6679-8xv2 CVE-2026-421742026/4/23
User avatar creation, replacement and deletion are not gated by user update permissions
MEDIUMGHSA-9wfj-c55w-j9qr CVE-2026-328702026/4/23
XML Injection in the XML creator toolkit
HIGHGHSA-2h7v-4372-f6x2 CVE-2026-420692026/4/23
Read access to site, user and role information is not gated by permissions
HIGHGHSA-85x2-r8xv-ww8c CVE-2026-421372026/4/23
`pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
HIGHGHSA-6gqr-mx34-wh8r CVE-2026-413252026/4/23
Page, file and user creation APIs bypass `create` permission check via unfiltered `blueprint` parameter
HIGHGHSA-jcjw-58rv-c452 CVE-2026-345872026/4/23
Server-Side Template Injection (SSTI) via double template resolution in option rendering
MEDIUMGHSA-4j78-4xrm-cr2f CVE-2026-218962026/1/8
Missing permission checks in the content changes API
MEDIUMGHSA-84hf-8gh5-575j CVE-2025-650122025/11/18
Cross-site scripting (XSS) in the changes dialog
LOWGHSA-9p3p-w5jf-8xxg CVE-2025-302072025/5/13
Path traversal in the router for PHP's built-in server
MEDIUMGHSA-x275-h9j4-7p4h CVE-2025-314932025/5/13
Path traversal of collection names during file system lookup
MEDIUMGHSA-fw82-87p8-v6hp CVE-2025-301592025/5/13
Path traversal of snippet names during file system lookup
HIGHGHSA-jm9m-rqr3-wfmh CVE-2024-419642024/8/29
Insufficient permission checks in the language settings
MEDIUMGHSA-xrvh-rvc4-5m43 CVE-2024-264832024/2/26
Unrestricted file upload of user avatar images
MEDIUMGHSA-63h4-w25c-3qv4 CVE-2024-270872024/2/26
Cross-site scripting (XSS) in the link field "Custom" type
MEDIUMGHSA-57f2-8p89-66x6 CVE-2024-264812024/2/26
Self cross-site scripting (self-XSS) in the URL field
MEDIUMGHSA-3v6j-v3qc-cxff CVE-2023-384922023/7/27
Denial of service from unlimited password lengths
HIGHGHSA-5mvj-rvp8-rf45 CVE-2023-384892023/7/27
Insufficient Session Expiration after a password change
MEDIUMGHSA-8fv7-wq38-f5c9 CVE-2023-384912023/7/27
Cross-site scripting (XSS) from MIME type auto-detection of uploaded files