Vendors / Pagekit Records 15 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 4
CVSS high 4
Exploited now Pagekit records in CISA KEV No Pagekit vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00499 · Published 2025-12-17 · No fix listed CWE-639
Priority HIGH 76
An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVSS 3.1 CRITICAL 9.9· Network · Low privileges · No interaction · EPSS 0.00535 · Published 2025-12-17 · No fix listed CWE-434
Priority HIGH 75
A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.18349 · Published 2022-09-20 · No fix listed CWE-434
Priority HIGH 69
An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php
CVSS 3.1 HIGH 7.8· Local · No auth · User interaction · EPSS 0.00564 · Published 2023-08-28 · No fix listed CWE-94
Priority MEDIUM 55
Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.
CVSS 3.1 MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.0039 · Published 2024-10-01 · No fix listed CWE-79
Priority MEDIUM 45
pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01537 · Published 2022-04-01 · No fix listed CWE-89
Priority MEDIUM 43
An issue was discovered in Pagekit CMS before 1.0.11.
CVSS 3.1 HIGH 7.5· Network · No auth · User interaction · EPSS 0.07005 · Published 2017-01-25 · Fixed in 1.0.11 CWE-640
Priority LOW 39
A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.
CVSS 3.1 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00764 · Published 2019-11-22 · No fix listed CWE-352
Priority LOW 29
Pagekit before 1.0.14 has a /user/login?redirect= open redirect vulnerability.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00957 · Published 2018-07-18 · Fixed in 1.0.14 CWE-601
Priority LOW 28
A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00597 · Published 2022-08-28 · No fix listed CWE-79
Priority LOW 28
Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.
CVSS 3.0 MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.03105 · Published 2018-06-01 · No fix listed CWE-79
Priority LOW 26
The Reset Password feature in Pagekit 1.0.17 gives a different response depending on whether the e-mail address of a valid user account is entered, which might make it easier for attackers to enumerate accounts.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01106 · Published 2019-09-21 · No fix listed CWE-203
Priority LOW 25
In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00541 · Published 2021-06-16 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
4 4 7 0 0
THREATIST.IORead the docs