CVE-2026-72574

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...

PT-2026-69458

Name of the Vulnerable Software and Affected Versions picocms/Pico versions prior to 2.1.5 Description A host header injection issue allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When the base url is unset, the getBaseUrl...