Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

pagekit/pagekit

13 known vulnerabilities (3 critical, 1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
13 · 3 critical, 1 medium
Registry
Packagist

Advisories 13

  • CVE-2025-67165Critical 9.8

    An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.

    Affected: through 1.0.18.

  • CVE-2025-67164Critical 9.9

    An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute…

    Affected: through 1.0.18.

  • CVE-2024-45967Medium 4.7

    Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.

    Affected: through 1.0.18.

  • An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in…

    Affected: through 1.0.18.

  • CVE-2022-38916Critical 9.8

    A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files

    Affected: through 1.0.18.

  • A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted…

    Affected: through 1.0.18.

  • pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.

    Affected: through 1.0.18.

  • In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS.

    Affected: through 1.0.18.

  • A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.

    Affected: through 1.0.17.

  • The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is…

    Affected: versions 1.0.17.

  • Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.

    Affected: fixed in 1.0.14.

  • Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.

    Affected: versions 1.0.13.

  • An issue was discovered in Pagekit CMS before 1.0.11.

    Affected: fixed in 1.0.11.