CVE-2018-18087

The CVE concerns the Pagekit Bixie Portfolio plugin 1.2.0 . Affected component: the portfolio editor’s Image URL field . Root cause: an XSS vulnerability allowing a logged-in user with the Manage portfolio privilege to inject arbitrary script/HTML, triggered by visiting the URL path /portfolio/${...

Open Redirect

pagekit/pagekit is vulnerable to open redirect attacks. The vulnerability exists due to the lack of sanitization of the $redirect variable that is used to redirect users...

CVE-2018-14381

Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability...

Open redirect

Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability...

CVE-2018-14381

Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability...

CVE-2018-14381

CVE-2018-14381 affects Pagekit prior to 1.0.14 and is an open redirect vulnerability located in the login flow via the /user/login?redirect= parameter. The root cause reported by multiple sources is the lack of proper sanitization/validation of the redirect parameter, enabling redirection to arbi...

CVE-2018-14381

Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability...

Pagekit < 1.0.13 - Cross-Site Scripting Code Generator Exploit

Exploit for php platform in category web applications Title: Pagekit ' + code + '' f = openname, 'w+' f.writecode f.close if name == 'main': print''' / \ \ / / | | \ / / | / / | | / / | || | | | \ \ / /| | | | | | |/ \ | | | | ' | || | | | \ V / | ||/ /| || | | || | | | | | | / || ||/||/...

Pagekit 1.0.13 - Cross-Site Scripting Code Generator

Pagekit 1.0.13 - Cross-Site Scripting Code Generator Title: Pagekit ' + code + '' f = openname, 'w+' f.writecode f.close if name == 'main': print''' / \ \ / / | | \ / / | / / | | / / | || | | | \ \ / /| | | | | | |/ \ | | | | ' | || | | | \ V / | ||/ /| || | | || | | | | | | / || ||/||/ |||/...

Pagekit Cross Site Scripting Code Generator

Title: Pagekit ' + code + '' f = openname, 'w+' f.writecode f.close if name == 'main': print''' / \ \ / / | | \ / / | / / | | / / | || | | | \ \ / /| | | | | | |/ \ | | | | ' | || | | | \ V / | ||/ /| || | | || | | | | | | / || ||/||/ |||/ / || Author : DEEPIN2Junseo Lee''' print' enter...

Pagekit &lt; 1.0.13 - Cross-Site Scripting Code Generator

Title: Pagekit ' + code + '' f = openname, 'w+' f.writecode f.close if name == 'main': print''' / \ \ / / | | \ / / | / / | | / / | || | | | \ \ / /| | | | | | |/ \ | | | | ' | || | | | \ V / | ||/ /| || | | || | | | | | | / || ||/||/ |||/ / || Author : DEEPIN2Junseo Lee''' print' enter...

CVE-2018-11564

Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user...

CVE-2018-11564

Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user...

Cross site scripting

Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user...

CVE-2018-11564

CVE-2018-11564 affects PageKit/YOOtheme Pagekit ≤ 1.0.13. A stored XSS occurs when a privileged user uploads an SVG image via the picture upload feature; the file is not stripped/filtered. An attacker can then craft a link to “/storage/poc.svg” that, when clicked by another user, triggers XSS. Co...

CVE-2018-11564

Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user...

PageKit CMS 1.0.13 Cross Site Scripting

CVE ID: CVE-2018-11564 Stored XSS in PageKit CMS 1.0.13 allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The...

Password Reset And Recovery

pagekit/pagekit is vulnerable to password reset and recovery. Attackers are able to reset a registered user's password when the debug toolbar is enabled. By doing this, attackers are able to recover the password...

PageKit Authentication Bypass Vulnerability

Pagekit CMS is a modular, lightweight CMS based website builder. An authentication bypass vulnerability exists in Pagekit CMS 1.0.10 and earlier versions. A remote attacker can exploit this vulnerability to reset the password of a registered user...

CVE-2017-5594

An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7PGKT01...