Cross-Site Request Forgery (CSRF)

pagekit/pagekit is vulnerable to cross-site request forgery CSRF. The application does not properly validate the csrf value in the POST request to upload a file, allowing a remote attacker to upload a file on behalf of the user when an authenticated user is tricked into visiting a malicious site...

CVE-2019-19013

A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request...

CVE-2019-19013

A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request...

Cross site request forgery (csrf)

A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request...

CVE-2019-19013

A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request...

CVE-2019-19013

CVE-2019-19013 describes a CSRF vulnerability in Pagekit 1.0.17 that allows an attacker to upload an arbitrary file by removing the CSRF token from a request. The issue is documented across multiple sources (e.g., Red Hat, Veracode, OSV, GHSA) with consistent wording and identification of Pagekit...

CVE-2019-19013

A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request...

Pagekit CMS Cross-Site Request Forgery Vulnerability

Pagekit CMS is a modern lightweight open source CMS. Pagekit CMS suffers from a cross-site request forgery vulnerability that can be exploited by an attacker to upload arbitrary files by removing a CSRF token from the request...

Pagekit CMS 1.0.17 Cross Site Request Forgery

Title: ==== Pagekit CMS 1.0.17 Cross-Site Request Forgery CSRF vulnerability Credit: ====== Name: Christian Bortone CVE: ==== CVE-2019-19013 Date: ==== 11/18/2019 dd/mm/yyyy Vendor: ====== Pagekit is a modern and lightweight open source CMS. Vendor link: https://pagekit.com/ Vulnerable Product:...

Information Disclosure

pagekit/pagekit is vulnerable to information disclosure. The vulnerability exists as the ResetPasswordController returns an Unknown email address. message when an email is not in the user database...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

Design/Logic Flaw

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts...

CVE-2019-16669

The CVE-2019-16669 issue concerns Pagekit 1.0.17, where Reset Password returns responses that differ depending on whether the entered e‑mail matches a valid user. This behavior enables user enumeration (information disclosure) by attackers, as described across multiple sources (CVE records, Red H...

Pagekit Bixie Portfolio plugin cross-site scripting vulnerability

Pagekit is a modular, lightweight CMS Content Management System.Bixie Portfolio plugin is used in one of the portfolio plugins. A cross-site scripting vulnerability exists in version 1.2.0 of the Pagekit Bixie Portfolio plugin. A remote attacker can exploit this vulnerability to inject arbitrary...

Code injection

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...

CVE-2018-18087

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...

CVE-2018-18087

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...

CVE-2018-18087

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...