PT-2018-14341

Name of the Vulnerable Software and Affected Versions Bixie Portfolio plugin version 1.2.0 Description The issue allows a logged-in user with the "Manage portfolio" privilege to inject arbitrary web script or HTML via the Image URL field in the portfolio editor. This is triggered by visiting the...

CVE-2018-18087: Improper Neutralization of Input During Web Page Generation

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/$projecttitle...