Skip to content
OpenAdvisories

Vendor

picocms

1 known vulnerabilities.

Products

Pico 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2026-72574

    picocms Pico - Host Header Injection Enables Script Source Hijacking

    A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.ph…

    picocms Pico