Unrestricted file upload

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

CVE-2020-21564

CVE-2020-21564 concerns Pluck CMS versions 4.7.10-dev2 and 4.7.11, where a file upload vulnerability can lead to remote command execution via the endpoint admin.php?action=files. The sources provided describe the vulnerability but do not specify additional technical details, exploit status, affec...

CVE-2020-21564

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

Command execution vulnerability in Pluck-CMS th***.php file

Pluck is a very simple and easy to use CMS Content Management System for PHP platforms. A command execution vulnerability exists in the Pluck-CMS th.php file, which can be exploited by an attacker to obtain application control privileges to get a webshell...

Command Execution Vulnerability in Pluck CMS

Pluck CMS is a content management system CMS written in php. Pluck CMS suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the web server...

Pluck CMS suffers from a file upload vulnerability

Pluck CMS is a content management system CMS written in php. Pluck CMS suffers from a file upload vulnerability that can be exploited by an attacker to gain control of the web server...

Pluck Code Issue Vulnerability

Pluck is a content management system CMS developed using the PHP language. A code issue vulnerability exists in the data/inc/images.php file in Pluck 4.7.4 and earlier versions. The vulnerability stems from an improperly designed or implemented code development process for a web-based system or...

Pluck Cross-Site Request Forgery Vulnerability (CNVD-2019-05779)

Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck version 4.7.9-dev1. A remote attacker can exploit this vulnerability by deleting a theme with /admin.php?action=themedelete&var1= URI...

Pluck Cross-Site Request Forgery Vulnerability (CNVD-2019-05782)

Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck version 4.7.9-dev1. A remote attacker can exploit this vulnerability to delete articles with /admin.php?action=deletepage&var1= URI...

Pluck Cross-Site Request Forgery Vulnerability

Pluck is a simple content management system CMS written in PHP. A cross-site request forgery vulnerability exists in Pluck version 4.7.7. A remote attacker can exploit this vulnerability to perform unauthorized actions e.g., changing the site name and email parameters with the help of the...

Pluck cross-site scripting vulnerability (CNVD-2018-25042)

Pluck is a simple content management system CMS written in PHP. A cross-site scripting vulnerability exists in Pluck version 4.7.7. A remote attacker can exploit this vulnerability by sending the 'title' field to the admin.php?action=editpage&page=14253123 URL to execute malicious script...

Pluck Cross-Site Scripting Vulnerability

Pluck is a simple content management system CMS written in PHP. A cross-site scripting vulnerability exists in Pluck version 4.7.7, which can be exploited by remote attackers to execute scripts via SVG files with Javascript code in the SCRIPT element...

Pluck PHP Code Upload and Execution Vulnerability

Pluck is a simple content management system CMS written in PHP. A security vulnerability exists in the /data/inc/images.php file in Pluck versions prior to 4.7.7-dev2. A remote attacker can exploit this vulnerability by uploading an image/jpeg type .htaccess file to upload and execute arbitrary P...

Pluck Cross-Site Scripting Vulnerability

pluk is a simple content management system CMS written in PHP. A security vulnerability exists in versions prior to pluck 4.7.6, which stems from the program failing to properly restrict the character set for filenames. A remote attacker can exploit this vulnerability to inject arbitrary web scri...

Pluck CMS 4.7.4 Cross Site Request Forgery

============================================== Exploit Title : pluck-cms vulnerability CSRF Reported Date : 8 - 10 - 2017 Exploit Author : Ashiyane Digital Security Team CWE: CSRF - 352 Tested On : kali Linux Vendor Homepage : https://www.pluck-cms.org/ Software Link :...

Pluck CMS Arbitrary Code Execution Vulnerability

Pluck CMS is a content management system CMS written in php. An arbitrary code execution vulnerability exists in Pluck CMS version 4.7.2. A remote attacker can exploit this vulnerability to execute arbitrary code via the log form feature...

Pluck CMS TinyMCE Cross-Site Scripting Vulnerability

Pluck CMS is a content management system CMS written in php.TinyMCE is one of the browser-based visual HTML editors. A cross-site scripting vulnerability exists in TinyMCE in Pluck CMS version 4.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross site scripting

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

Design/Logic Flaw

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

CVE-2014-8707

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...