Detections
Analytics
SCA: security update for getkirby/cms (GHSA-84hf-8gh5-575j)
medium Tenable Cloud Security Plugin ID 436093
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change
the title of any page or the name of any user to a malicious string. Then they could modify any content
field of the same model without saving, making the model a candidate for display in the "Changes" dialog.
If another authenticated user subsequently opened the dialog in their Panel, the malicious code would be
executed. This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of
authenticated Panel users or that allow external visitors to update page titles or usernames. The attack
requires user interaction by another Panel user and cannot be automated. This issue has been patched in
version 5.1.4. (CVE-2025-65012)
See Also
Plugin Details
Severity: Medium
ID: 436093
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 11/18/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.39
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.1
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N
CVSS Score Source: CVE-2025-65012
CVSS v3
Risk Factor: Medium
Base Score: 5.4
Temporal Score: 4.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.1
Threat Score: 1.2
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 11/18/2025
Vulnerability Publication Date: 11/18/2025
Reference Information
CVE: CVE-2025-65012
cwe: CWE-79