Design/Logic Flaw

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg...

PT-2017-17711

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is achieved by sending a POST request to the "admin/index.php?s=publish&x=filemanager" endpoint with a filename that has...

CVE-2017-7362: Improper Neutralization of Input During Web Page Generation

Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack...

PT-2017-17684

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack. The attack can be performed through the "s=publish&m=static&x=" parameter in the admin/index.php endpoint. Recommendations For Pixie version 1.0.4, update to a version that...

CVE-2017-7361: Improper Neutralization of Input During Web Page Generation

Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack...

CVE-2017-7363: Improper Neutralization of Input During Web Page Generation

Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack...

PT-2017-17685

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack. The attack can be performed through the "s=publish&m=dynamic&x=" parameter in the admin/index.php endpoint. Recommendations For Pixie version 1.0.4, update to a version that...

PT-2017-17686

Name of the Vulnerable Software and Affected Versions Pixie version 1.0.4 Description The issue allows for an XSS attack. The attack can be performed through the admin/index.php endpoint with specific parameters set, such as s=publish, m=module, and x. Recommendations For Pixie version 1.0.4, as ...