Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in

CVE-2020-29607

🗓️ 16 Dec 2020 14:28:27Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 208 Views🌐 WEB

A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain host access through "manage files" functionality, leading to remote code execution

Related
Detection
Refs
Paths
Social
ReporterTitlePublishedViews
Family
githubexploit
GithubExploit		Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck
28 Feb 202600:00
–githubexploit
githubexploit
GithubExploit		Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck
4 Jun 202221:09
–githubexploit
githubexploit
GithubExploit		Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck
27 Oct 202500:46
–githubexploit
githubexploit
GithubExploit		Exploit for Unrestricted Upload of File with Dangerous Type in Pluck-Cms Pluck
4 Jun 202221:09
–githubexploit
zdt
zdt		Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated) Exploit
26 May 202100:00
–zdt
circl
Circl		CVE-2020-29607
16 Dec 202018:41
–circl
cnnvd
CNNVD		Pluck Code Issue Vulnerability
16 Dec 202000:00
–cnnvd
checkpoint_advisories
Check Point Advisories		p0wny Shell Remote Code Execution (CVE-2017-9830; CVE-2018-15139; CVE-2018-19423; CVE-2018-6383; CVE-2020-29607; CVE-2021-24155; CVE-2021-24347)
19 Oct 202100:00
–checkpoint_advisories
cvelist
Cvelist		CVE-2020-29607
16 Dec 202014:28
–cvelist
exploitdb
Exploit DB		Pluck CMS 4.7.13 - File Upload Remote Code Execution (Authenticated)
26 May 202100:00
–exploitdb
Rows per page
NVD
Node
pluck-cmspluckRange<4.7.13
ParameterPositionPathDescriptionCWE
cont1request body/login.phpAuthentication request to Pluck CMS login endpoint used in the PoC before uploading a webshell.CWE-434
bogusrequest body/login.phpAuthentication request to Pluck CMS login endpoint used in the PoC before uploading a webshell.CWE-434
submitrequest body/login.phpAuthentication request to Pluck CMS login endpoint used in the PoC before uploading a webshell.CWE-434
filefilerequest body/admin.php?action=filesUpload of a webshell via the admin 'manage files' interface to achieve remote code execution.CWE-434

New post from https://t.co/uXvPWJy6tj?amp=1 (Pluck CMS up to 4.7.13 unrestricted upload [CVE-2020-29607]) has been published on https://t.co/ETLPfNzDBC?amp=1

Pluck CMS up to 4.7.13 unrestricted upload [CVE-2020-29607] A vulnerability, which was classified as critical, was found in Pluck CMS up to 4.7.13 (Content Management System). Affected is some unknown functionality. Upgrading eliminates this vulnerabilit… https://t.co/TDwiYaDzsN?amp=1

New post from https://t.co/9KYxtdZjkl?amp=1 (Pluck CMS up to 4.7.13 unrestricted upload [CVE-2020-29607]) has been published on https://t.co/Qrz5GdkA3E?amp=1

threatmeter: Pluck CMS up to 4.7.13 unrestricted upload [CVE-2020-29607] A vulnerability, which was classified as critical, was found in Pluck CMS up to 4.7.13 (Content Management System). Affected is some unknown functionality. Upgrading eliminates this… https://t.co/V2sqUbAw73?amp=1

ksg93rd

#exploit 1. Tomcat CVE-2022-29885 https://t.co/EvwAxYR0TM 2. CVE-2021-25076: Wordpress Plugin WP User Frontend < 3.5.26 - SQL-Injection https://t.co/GBzkwulMQL 3. CVE-2020-29607: Pluck CMS 4.7.13 - File Upload RCE

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 03:11Current
7.9High risk
Vulners AI Score7.9
CVSS 26.5
CVSS 3.17.2
EPSS0.33194
CWE-434
cve-2020-29607pluck cmsfile uploadrestriction bypassvulnerabilityadmin privileged userhost accessremote code execution
208