CVE-2017-5594 Pagekit Weak Password Recovery Mechanism for Forgotten Password

What is CVE-2017-5594?

CVE-2017-5594 is a high-severity authentication bypass vulnerability in n/a, published on 25 Jan 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7_PGKT_01.

Weakness: CWE-640

Which versions are affected by CVE-2017-5594?

2 open source packages ship an affected version, including pagekit/pagekit. It affects 1 product.

Products include Pagekit Pagekit.

How do I fix CVE-2017-5594?

Upgrade pagekit/pagekit to 1.0.11 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2017-5594 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-5594 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2025-67164 Pagekit CMS is vulnerable to OS Command Injection via Storage component Critical 9.9
• CVE-2025-67165 Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component Critical 9.8
• CVE-2022-38916 Pagekit vulnerable to Unrestricted Upload of File with Dangerous Type Critical 9.8
• CVE-2021-44135 SQL injection in pagekit/pagekit Critical 9.8
• CVE-2019-19013 Pagekit File Upload vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rp89-32rp-qpq2.