Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
pluck vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv2
CVE-2022-26965
In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.
Pluck-cms Pluck 4.7.16
3 Github repositories
NA
CVE-2020-20918
An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote malicious user to execute arbitrary php code via the hidden parameter to admin.php when editing a page.
Pluck-cms Pluck 4.7.10
NA
CVE-2020-20919
File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote malicious user to execute arbitrary code and access sensitive information via the theme.php file.
Pluck-cms Pluck 4.7.10
7.5
CVSSv2
CVE-2020-20951
In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.
Pluck-cms Pluck 4.7.10
NA
CVE-2020-20969
File Upload vulnerability in PluckCMS v.4.7.10 allows a remote malicious user to execute arbitrary code via the trashcan_restoreitem.php file.
Pluck-cms Pluck 4.7.10
5.8
CVSSv2
CVE-2019-9051
An issue exists in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI.
Pluck-cms Pluck 4.7.9
NA
CVE-2023-50564
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows malicious users to execute arbitrary code via uploading a crafted ZIP file.
Pluck-cms Pluck 4.7.18
NA
CVE-2023-5013
A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')&l...
Pluck-cms Pluck 4.7.18
7.5
CVSSv2
CVE-2019-11344
data/inc/files.php in Pluck 4.7.8 allows remote malicious users to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked.
Pluck-cms Pluck 4.7.8
4
CVSSv2
CVE-2014-8707
Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option.
Pluck-cms Pluck 4.7.2
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injection
SSRF
buffer overflow
CVE-2023-28952
CVE-2023-41822
CVE-2024-27956
CVE-2023-7028
CVE-2024-34447
CVE-2024-34460
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »