CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-11564

Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature. A user with elevated privileges could upload a photo to the system in an SVG format. This file will be uploaded to the system and it will not be stripped or filtered. The user can create a link on the website pointing to "/storage/poc.svg" that will point to http://localhost/pagekit/storage/poc.svg. When a user comes along to click that link, it will trigger a XSS attack.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.004

EPSS Ranking 59.3%

CVSS Severity

CVSS v3 Score 4.8

CVSS v2 Score 3.5

References

Products affected by CVE-2018-11564

Pagekit » Pagekit » Version: 0.10.0

cpe:2.3:a:pagekit:pagekit:0.10.0
Pagekit » Pagekit » Version: 0.10.1

cpe:2.3:a:pagekit:pagekit:0.10.1
Pagekit » Pagekit » Version: 0.10.2

cpe:2.3:a:pagekit:pagekit:0.10.2
Pagekit » Pagekit » Version: 0.10.3

cpe:2.3:a:pagekit:pagekit:0.10.3
Pagekit » Pagekit » Version: 0.10.4

cpe:2.3:a:pagekit:pagekit:0.10.4
Pagekit » Pagekit » Version: 0.11.1

cpe:2.3:a:pagekit:pagekit:0.11.1
Pagekit » Pagekit » Version: 0.11.2

cpe:2.3:a:pagekit:pagekit:0.11.2
Pagekit » Pagekit » Version: 0.11.3

cpe:2.3:a:pagekit:pagekit:0.11.3
Pagekit » Pagekit » Version: 0.8.8

cpe:2.3:a:pagekit:pagekit:0.8.8
Pagekit » Pagekit » Version: 0.9.0

cpe:2.3:a:pagekit:pagekit:0.9.0
Pagekit » Pagekit » Version: 0.9.1

cpe:2.3:a:pagekit:pagekit:0.9.1
Pagekit » Pagekit » Version: 0.9.2

cpe:2.3:a:pagekit:pagekit:0.9.2
Pagekit » Pagekit » Version: 0.9.3

cpe:2.3:a:pagekit:pagekit:0.9.3
Pagekit » Pagekit » Version: 0.9.4

cpe:2.3:a:pagekit:pagekit:0.9.4
Pagekit » Pagekit » Version: 0.9.5

cpe:2.3:a:pagekit:pagekit:0.9.5
Pagekit » Pagekit » Version: 1.0.0

cpe:2.3:a:pagekit:pagekit:1.0.0
Pagekit » Pagekit » Version: 1.0.1

cpe:2.3:a:pagekit:pagekit:1.0.1
Pagekit » Pagekit » Version: 1.0.10

cpe:2.3:a:pagekit:pagekit:1.0.10
Pagekit » Pagekit » Version: 1.0.11

cpe:2.3:a:pagekit:pagekit:1.0.11
Pagekit » Pagekit » Version: 1.0.12

cpe:2.3:a:pagekit:pagekit:1.0.12
Pagekit » Pagekit » Version: 1.0.13

cpe:2.3:a:pagekit:pagekit:1.0.13
Pagekit » Pagekit » Version: 1.0.2

cpe:2.3:a:pagekit:pagekit:1.0.2
Pagekit » Pagekit » Version: 1.0.3

cpe:2.3:a:pagekit:pagekit:1.0.3
Pagekit » Pagekit » Version: 1.0.4

cpe:2.3:a:pagekit:pagekit:1.0.4
Pagekit » Pagekit » Version: 1.0.5

cpe:2.3:a:pagekit:pagekit:1.0.5
Pagekit » Pagekit » Version: 1.0.6

cpe:2.3:a:pagekit:pagekit:1.0.6
Pagekit » Pagekit » Version: 1.0.7

cpe:2.3:a:pagekit:pagekit:1.0.7
Pagekit » Pagekit » Version: 1.0.8

cpe:2.3:a:pagekit:pagekit:1.0.8
Pagekit » Pagekit » Version: 1.0.9

cpe:2.3:a:pagekit:pagekit:1.0.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-11564

Products

Pricing

Contact Us