PT-2026-69458

Name of the Vulnerable Software and Affected Versions picocms/Pico versions prior to 2.1.5 Description A host header injection issue allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When the base url is unset, the getBaseUrl...

CVE-2026-72574: Improper Neutralization of HTTP Headers for Scripting Syntax

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When baseurl is unset the default, Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated...