Medium · 6.1 CVE-2022-36573 EUVD-2022-6603GHSA-q6h8-qjjc-j8cg

Pagekit CMS cross-site scripting in Markdown text box where articles are edited

Published Aug 28, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Package: pagekit/pagekit Ecosystem: Packagist

Description

A cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	pagekit/pagekit	<= 1.0.18	—	GHSA-q6h8-qjjc-j8cg

References

https://github.com/pagekit/pagekit/issues/968