picocms

Records1All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

picocms records in CISA KEV

No picocms vulnerabilities are listed in CISA KEV.

Records

1 record

TI-2026-50832 CVE-2026-72574 · GHSA-563g-2g6p-xmpf

picocms Pico - Host Header Injection Enables Script Source Hijacking

LOW 28

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00421 Published 2026-08-10 No fix listed CWE-644

Open these records in search →

Critical	0
High	0
Medium	1
Low	0
No CVSS	0