VYPR
← All advisories
Medium severity5.4OSV Advisory· Published Oct 9, 2018· Updated Jun 17, 2026

CVE-2018-18087

CVE-2018-18087

Description

The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the "Manage portfolio" privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/${project_title}.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Bixie/Pagekit PortfolioOSV2 versions
    0.8.0, 0.9.0, 0.9.1, …+ 1 more
    • (no CPE)range: 0.8.0, 0.9.0, 0.9.1, …
    • (no CPE)range: =1.2.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.