# pagekit/pagekit (Packagist) vulnerabilities

13 known vulnerabilities (3 critical, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/pagekit/pagekit

## Advisories (13)

### [CVE-2025-67165](https://cve.now/CVE-2025-67165): An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.

- Severity: Critical 9.8
- Published: Dec 17, 2025
- Affected: through 1.0.18.

### [CVE-2025-67164](https://cve.now/CVE-2025-67164): An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute…

- Severity: Critical 9.9
- Published: Dec 17, 2025
- Affected: through 1.0.18.

### [CVE-2024-45967](https://cve.now/CVE-2024-45967): Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.

- Severity: Medium 4.7
- Published: Oct 1, 2024
- Affected: through 1.0.18.

### [CVE-2023-41005](https://cve.now/CVE-2023-41005): An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in…

- Severity: Unrated
- Published: Aug 28, 2023
- Affected: through 1.0.18.

### [CVE-2022-38916](https://cve.now/CVE-2022-38916): A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files

- Severity: Critical 9.8
- Published: Sep 20, 2022
- Affected: through 1.0.18.

### [CVE-2022-36573](https://cve.now/CVE-2022-36573): A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted…

- Severity: Unrated
- Published: Aug 28, 2022
- Affected: through 1.0.18.

### [CVE-2021-44135](https://cve.now/CVE-2021-44135): pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.

- Severity: Unrated
- Published: Apr 1, 2022
- Affected: through 1.0.18.

### [CVE-2021-32245](https://cve.now/CVE-2021-32245): In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS.

- Severity: Unrated
- Published: Jun 16, 2021
- Affected: through 1.0.18.

### [CVE-2019-19013](https://cve.now/CVE-2019-19013): A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.

- Severity: Unrated
- Published: Nov 22, 2019
- Affected: through 1.0.17.

### [CVE-2019-16669](https://cve.now/CVE-2019-16669): The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is…

- Severity: Unrated
- Published: Sep 21, 2019
- Affected: versions 1.0.17.

### [CVE-2018-14381](https://cve.now/CVE-2018-14381): Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.

- Severity: Unrated
- Published: Jul 18, 2018
- Affected: fixed in 1.0.14.

### [CVE-2018-11564](https://cve.now/CVE-2018-11564): Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.

- Severity: Unrated
- Published: Jun 1, 2018
- Affected: versions 1.0.13.

### [CVE-2017-5594](https://cve.now/CVE-2017-5594): An issue was discovered in Pagekit CMS before 1.0.11.

- Severity: Unrated
- Published: Jan 25, 2017
- Affected: fixed in 1.0.11.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/pagekit/pagekit
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.