Lucene search
GoogleOSV:GHSA-3RWJ-V7JP-W542HistoryMay 14, 2022 - 3:14 a.m.
Pagekit Stored Cross-site Scripting
2022-05-1403:14:51
Google
osv.dev
5
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to “/storage/poc.svg” that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack.
| CPE | Name | Operator | Version |
|---|---|---|---|
| pagekit/pagekit | eq | 1.0.13 |
Related
packetstorm
packetstorm
PageKit CMS 1.0.13 Cross Site Scripting
2018-05-31 00:00:00
Pagekit Cross Site Scripting Code Generator
2018-06-05 00:00:00
cve
cve
CVE-2018-11564
2018-06-02 01:29:05
osv
osv
CVE-2018-11564
2018-06-02 01:29:05
zdt
zdt
Pagekit < 1.0.13 - Cross-Site Scripting Code Generator Exploit
2018-06-06 00:00:00
prion
prion
Cross site scripting
2018-06-02 01:29:00
cvelist
cvelist
CVE-2018-11564
2018-06-01 21:00:00
nvd
nvd
CVE-2018-11564
2018-06-02 01:29:05
github
github
Pagekit Stored Cross-site Scripting
2022-05-14 03:14:51