Read the docs
TI-2017-03596 Aliases CVE-2017-5594GHSA-rp89-32rp-qpq2

An issue was discovered in Pagekit CMS before 1.0.11.

Priority MEDIUM 43CWE-640Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-640.

Summary

An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.

Why it matters now

EPSS 0.07005 94th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed pagekit/pagekit (Packagist): 1.0.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—pagekit/pagekit (Packagist)before 1.0.111.0.11Patch availableGHSA-rp89-32rp-qpq2
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • pagekit/pagekit (Packagist) Vendor— Affected before 1.0.11 Fixed in 1.0.11 Patch available GHSA-rp89-32rp-qpq2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pagekit:pagekit:*:*:*:*:*:*:*:*up to 1.0.10VulnerablePagekit
  • cpe:2.3:a:pagekit:pagekit:*:*:*:*:*:*:*:* Versions up to 1.0.10 Vulnerable ·Pagekit

Remediation

  • Fix · GHSA-rp89-32rp-qpq2 pagekit/pagekit (Packagist) Fixed in 1.0.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-5594
  2. 2026-10-03 Alias added: GHSA-rp89-32rp-qpq2

References

Exploit 2

Patch 1

Advisory 2

Other 2

  • TI-2025-41149 An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges. CVSS 3.1CRITICAL 9.8
  • TI-2025-41148 An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of… CVSS 3.1CRITICAL 9.9
  • TI-2022-18350 A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows… CVSS 3.1CRITICAL 9.8
  • TI-2023-21646 An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code… CVSS 3.1HIGH 7.8
  • TI-2024-30850 Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget. CVSS 3.1MEDIUM 4.7
  • TI-2021-19838 pagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing. CVSS 3.1CRITICAL 9.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences