CVE-2022-26965: Unrestricted Upload of File with Dangerous Type

In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution...

PT-2022-18145

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.16 Description The issue allows an admin user to perform remote code execution using the theme upload functionality. This is achieved through the "/admin.php?action=themeinstall" endpoint. Recommendations For Pluck version...