Pluck CMS Arbitrary Code Execution Vulnerability

Pluck CMS is a content management system CMS written in php. An arbitrary code execution vulnerability exists in Pluck CMS version 4.7.2. A remote attacker can exploit this vulnerability to execute arbitrary code via the log form feature...

Cross site scripting

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

CVE-2014-8706

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

CVE-2014-8708

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

Design/Logic Flaw

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

CVE-2014-8707

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

Code injection

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

CVE-2014-8707

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

CVE-2014-8706

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

CVE-2014-8707

Summary: CVE-2014-8707 is a cross-site scripting (XSS) vulnerability in TinyMCE within Pluck CMS version 4.7.2. The flaw allows remote authenticated users to inject arbitrary script/HTML via the TinyMCE “edit HTML source” option. The connected CNVD entry for Pluck CMS confirms a TinyMCE XSS issue...

CVE-2014-8706

CVE-2014-8706 affects Pluck CMS 4.7.2 and is an information disclosure issue. The vulnerability occurs when a remote attacker can cause PHPSESSID to be treated as an array or altered with non-alphanumeric characters, or manipulate the image parameter to an array or string, which results in an err...

CVE-2014-8708

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

CVE-2014-8708

Pluck CMS 4.7.2 is affected. A remote attacker can execute arbitrary code via the blog form feature, as reported by multiple sources (NVD/CNVD equivalents). Root cause details are not explicitly described in the provided documents beyond the blog form vector. No remediation or patch information i...

Pluck CMS 4.7.3 Add-Page Cross Site Request Forgery

Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery Exploit Author: Ahsan Tahir Date: 18-10-2016 Software Link: http://www.pluck-cms.org/?file=download Vendor: http://www.pluck-cms.org/ Google Dork: "2005-2016. pluck is available" Contact: https://twitter.com/AhsanTahirAT |...

Pluck CMS 4.7.3 - Cross-Site Request Forgery (Add Page)

Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery Exploit Author: Ahsan Tahir Date: 18-10-2016 Software Link: http://www.pluck-cms.org/?file=download Vendor: http://www.pluck-cms.org/ Google Dork: "2005-2016. pluck is available" Contact: https://twitter.com/AhsanTahirAT |...

Pluck CMS 4.7.3 - Cross-Site Request Forgery (Add Page)

Pluck CMS 4.7.3 - Cross-Site Request Forgery Add Page Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery Exploit Author: Ahsan Tahir Date: 18-10-2016 Software Link: http://www.pluck-cms.org/?file=download Vendor: http://www.pluck-cms.org/ Google Dork: "2005-2016. pluck is...

Pluck 4.7.3 - (Delete File) CSRF Web Vulnerability

Document Title: =============== Pluck 4.7.3 - Delete File CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1980 Release Date: ============= 2016-10-16 Vulnerability Laboratory ID VL-ID: ==================================== 1980...

Pluck CMS 4.7.3 - Multiple Vulnerabilities

Title: Pluck 4.7.3 - Multiple vulnerabilities Date: 28.08.15 Vendor: pluck-cms.org Affected versions: = 4.7.3 current Tested on: Apache2.2 / PHP5 / Deb32 Author: Smash | smaash.net Contact: smash at devilteam.pl Few vulnerabilities. Bugs: - local file inclusion - code execution - stored xss - csr...

Pluck CMS 4.7.3 - Multiple Vulnerabilities

Pluck CMS 4.7.3 - Multiple Vulnerabilities Title: Pluck 4.7.3 - Multiple vulnerabilities Date: 28.08.15 Vendor: pluck-cms.org Affected versions: = 4.7.3 current Tested on: Apache2.2 / PHP5 / Deb32 Author: Smash | smaash.net Contact: smash at devilteam.pl Few vulnerabilities. Bugs: - local file...

Pluck CMS 4.7.3 CSRF / XSS / LFI / Code Execution

Title: Pluck 4.7.3 - Multiple vulnerabilities Date: 28.08.15 Vendor: pluck-cms.org Affected versions: = 4.7.3 current Tested on: Apache2.2 / PHP5 / Deb32 Author: Smash | smaash.net Contact: smash at devilteam.pl Few vulnerabilities. Bugs: - local file inclusion - code execution - stored xss - csr...