Nurmurodov Asadbek

**Name of the Vulnerable Software and Affected Versions** picocms/Pico versions prior to 2.1.5 **Description** A host header injection issue allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When the `base url` is unset, the `getBaseUrl()` function in lib/Pico.php constructs the base URL using unvalidated `Host`, `X-Forwarded-Host`, `X-Forwarded-Proto`, and `X-Forwarded-Port` request headers. This causes `theme url`, `assets url`, and `plugins url` to point to an attacker-controlled domain, leading the application to load scripts and stylesheets from that external source. **Recommendations** Update picocms/Pico to version 2.1.5 or later. Set the `base url` configuration to a static value to prevent the application from relying on request headers to determine the base URL.

**Name of the Vulnerable Software and Affected Versions** Bludit version 4.0.0-beta **Description** A stored cross-site scripting (XSS) issue allows a low-privileged authenticated user with the Author role to inject arbitrary JavaScript. This occurs when a crafted SVG file is uploaded as the site logo via the '/admin/ajax/logo-upload' endpoint in `bl-kernel/ajax/logo-upload.php`. The system moves the uploaded file to the web root using the `Filesystem::mv()` function without calling `sanitizeSVG()` or `transformImage()`, despite SVG being included in the `ALLOWED IMG EXTENSION` and `ALLOWED IMG MIMETYPES` allow-lists. Consequently, a stored script tag within the SVG executes in the browser of any user who views the logo. **Recommendations** As a temporary mitigation, restrict the use of the '/admin/ajax/logo-upload' endpoint or remove SVG from the `ALLOWED IMG EXTENSION` and `ALLOWED IMG MIMETYPES` allow-lists. At the moment, there is no information about a newer version that contains a fix for this vulnerability.