CVE-2026-6983

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
Apr 25, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-698308.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized atCVE-2026-698324.7Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose inforCVE-2026-698347.0Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.CVE-2026-6983610.0Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.CVE-2026-698387.0Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-698396.5Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service over a network.CVE-2026-69844.7A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashbCVE-2026-698407.0Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.CVE-2026-698417.8Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.CVE-2026-6984310.0Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.CVE-2026-698447.8Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges locally.CVE-2026-698459.8Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-6983: Medium severity, CVSS 4.7 | Vulnix