CVE-2026-72574

Published: Ago 10, 2026 Last Modified: Ago 10, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,1
Source: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: changed
Confidentiality: low
Integrity: low
Availability: none

Description

AI Translation Available

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme. When base_url is unset (the default), Pico::getBaseUrl in lib/Pico.php builds the base URL from unvalidated Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port request headers.

644

Improper Neutralization of HTTP Headers for Scripting Syntax

Incomplete
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Integrity Confidentiality Availability
Potential Impacts:
Execute Unauthorized Code Or Commands Read Application Data
Applicable Platforms
Technologies: Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
https://github.com/picocms/Pico
https://github.com/picocms/Pico
https://github.com/picocms/Pico/blob/master/lib/Pico.php
https://github.com/picocms/Pico/blob/master/lib/Pico.php
https://picocms.org
https://picocms.org