Pagekit
Monthly
Privilege escalation to remote code execution in Pagekit CMS 1.0.18 lets an authenticated user holding the 'user: manage users' permission grant themselves arbitrary custom roles via an unprotected UserApiController::saveAction(), then assign a role carrying 'system: manage packages' to upload a malicious PHP package through the admin installer and run arbitrary code. Publicly available exploit code exists (gist by sermikr0, reported by VulnCheck), and the chain converts a limited management permission into full server compromise. No public evidence of active exploitation has been confirmed (not in CISA KEV).
Unauthenticated SQL injection in Pagekit CMS through version 1.0.18 lets a remote attacker inject SQL through the credentials array posted to the public login endpoint (POST /user/authenticate), enabling read-oriented extraction of database contents such as the user table and password hashes. No authentication, user interaction, or non-default configuration is required, so the only meaningful limiter is exposure - any internet-reachable vulnerable instance is directly exploitable. Publicly available exploit code exists (a GitHub repository demonstrating the Pagekit login SQLi is referenced), but there is no CISA KEV entry and EPSS is just 0.15% (5th percentile); note the supplied base score of 5.3 understates impact, since our independent assessment rates confidentiality as High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Server-side request forgery (SSRF) in Pagekit up to version 1.0.18 allows authenticated high-privilege administrators to manipulate the url parameter in the /index.php/admin/system/update/download endpoint, enabling them to force the server to make arbitrary HTTP requests to internal or external systems. Publicly available exploit code exists, and the vendor did not respond to early disclosure efforts.
Improper neutralization of directives in dynamically evaluated code in Pagekit CMS up to version 1.0.18 allows high-privileged remote attackers to inject and execute arbitrary PHP code through the StringStorage Template Handler's evaluate function in app/modules/view/src/PhpEngine.php. The vulnerability requires administrator-level access but enables information disclosure, code injection, and potential system compromise. Publicly available exploit code exists; the vendor has not responded to disclosure efforts.
Privilege escalation in Pagekit CMS 1.0.18 via an insecure direct object reference (CWE-639) lets an attacker manipulate the user-, role-, or permission-identifier supplied in a request and assign themselves elevated rights within Pagekit's roles-and-permissions model. Publicly available exploit code exists (published in an mbiesiad vulnerability-research repository), but the flaw is not listed in CISA KEV and EPSS is only 0.50% (41st percentile), so no active exploitation has been confirmed. NVD scores it 9.8 with a PR:N vector, whereas the authoritative assessment requires a valid low-privilege authenticated session (PR:L); exploitation is confined to deployments running the specific, largely unmaintained 1.0.18 release, which limits real-world exposure.
Authenticated attackers with low privileges can upload a crafted PHP file to Pagekit CMS 1.0.18 via the /storage/poc.php endpoint, leading to remote code execution on the server. Publicly available exploit code exists but no confirmed active exploitation (CISA KEV) is reported; EPSS is low at 0.53%, indicating a serious but not emergency-level threat. The vulnerability requires a valid account and improper file-type validation, and the independently assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8) reflects high impact with scope unchanged.
Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Pagekit CMS before 1.0.11. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Open redirect vulnerability in YOOtheme Pagekit CMS 0.8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in YOOtheme Pagekit CMS 0.8.7 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP Referer header to index.php/user or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Privilege escalation to remote code execution in Pagekit CMS 1.0.18 lets an authenticated user holding the 'user: manage users' permission grant themselves arbitrary custom roles via an unprotected UserApiController::saveAction(), then assign a role carrying 'system: manage packages' to upload a malicious PHP package through the admin installer and run arbitrary code. Publicly available exploit code exists (gist by sermikr0, reported by VulnCheck), and the chain converts a limited management permission into full server compromise. No public evidence of active exploitation has been confirmed (not in CISA KEV).
Unauthenticated SQL injection in Pagekit CMS through version 1.0.18 lets a remote attacker inject SQL through the credentials array posted to the public login endpoint (POST /user/authenticate), enabling read-oriented extraction of database contents such as the user table and password hashes. No authentication, user interaction, or non-default configuration is required, so the only meaningful limiter is exposure - any internet-reachable vulnerable instance is directly exploitable. Publicly available exploit code exists (a GitHub repository demonstrating the Pagekit login SQLi is referenced), but there is no CISA KEV entry and EPSS is just 0.15% (5th percentile); note the supplied base score of 5.3 understates impact, since our independent assessment rates confidentiality as High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Server-side request forgery (SSRF) in Pagekit up to version 1.0.18 allows authenticated high-privilege administrators to manipulate the url parameter in the /index.php/admin/system/update/download endpoint, enabling them to force the server to make arbitrary HTTP requests to internal or external systems. Publicly available exploit code exists, and the vendor did not respond to early disclosure efforts.
Improper neutralization of directives in dynamically evaluated code in Pagekit CMS up to version 1.0.18 allows high-privileged remote attackers to inject and execute arbitrary PHP code through the StringStorage Template Handler's evaluate function in app/modules/view/src/PhpEngine.php. The vulnerability requires administrator-level access but enables information disclosure, code injection, and potential system compromise. Publicly available exploit code exists; the vendor has not responded to disclosure efforts.
Privilege escalation in Pagekit CMS 1.0.18 via an insecure direct object reference (CWE-639) lets an attacker manipulate the user-, role-, or permission-identifier supplied in a request and assign themselves elevated rights within Pagekit's roles-and-permissions model. Publicly available exploit code exists (published in an mbiesiad vulnerability-research repository), but the flaw is not listed in CISA KEV and EPSS is only 0.50% (41st percentile), so no active exploitation has been confirmed. NVD scores it 9.8 with a PR:N vector, whereas the authoritative assessment requires a valid low-privilege authenticated session (PR:L); exploitation is confined to deployments running the specific, largely unmaintained 1.0.18 release, which limits real-world exposure.
Authenticated attackers with low privileges can upload a crafted PHP file to Pagekit CMS 1.0.18 via the /storage/poc.php endpoint, leading to remote code execution on the server. Publicly available exploit code exists but no confirmed active exploitation (CISA KEV) is reported; EPSS is low at 0.53%, indicating a serious but not emergency-level threat. The vulnerability requires a valid account and improper file-type validation, and the independently assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 8.8) reflects high impact with scope unchanged.
Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Pagekit CMS before 1.0.11. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Open redirect vulnerability in YOOtheme Pagekit CMS 0.8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in YOOtheme Pagekit CMS 0.8.7 allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP Referer header to index.php/user or. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.