CVE-2017-5594
HighSummary
An issue was discovered in Pagekit CMS before 1.0.11 that allows a remote attacker to reset a registered user's password when the debug toolbar is enabled. The password can be successfully recovered using this exploit.
Risk Assessment
This vulnerability poses a risk of unauthorized access to user accounts, potentially leading to data loss or privacy breaches.
Recommendation
It is recommended to update Pagekit CMS to version 1.0.11 or later and to disable the debug toolbar to minimize risk.
Other vulnerabilities in Pagekit CMS
See all- CVE-2025-67165Critical
Pagekit CMS version 1.0.18 contains an Insecure Direct Object Reference (IDOR) vulnerability that allows attackers to escalate privileges.
- CVE-2025-67164Critical
Pagekit CMS version 1.0.18 contains an authenticated arbitrary file upload vulnerability in the /storage/poc.php component, allowing attackers to execute arbitrary code by uploading a crafted PHP file.
- CVE-2026-57518High
Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to assign arbitrary custom roles to themselves due to missing authorization checks in UserApiController::saveAction(). Attackers can assign themselves a custom role with the 'system: manage packages' permission and then upload and install a malicious PHP package through the admin package installer to achieve remote code execution.
Original NVD description (English source)
An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.