CVE-2018-18087

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...

CVE-2018-18087

The CVE concerns the Pagekit Bixie Portfolio plugin 1.2.0 . Affected component: the portfolio editor’s Image URL field . Root cause: an XSS vulnerability allowing a logged-in user with the Manage portfolio privilege to inject arbitrary script/HTML, triggered by visiting the URL path /portfolio/${...