Cross site scripting

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

CVE-2014-8706

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

CVE-2014-8708

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

Design/Logic Flaw

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

CVE-2014-8707

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

Code injection

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

CVE-2014-8706

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

CVE-2014-8707

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

CVE-2014-8707

Summary: CVE-2014-8707 is a cross-site scripting (XSS) vulnerability in TinyMCE within Pluck CMS version 4.7.2. The flaw allows remote authenticated users to inject arbitrary script/HTML via the TinyMCE “edit HTML source” option. The connected CNVD entry for Pluck CMS confirms a TinyMCE XSS issue...

CVE-2014-8708

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

CVE-2014-8706

CVE-2014-8706 affects Pluck CMS 4.7.2 and is an information disclosure issue. The vulnerability occurs when a remote attacker can cause PHPSESSID to be treated as an array or altered with non-alphanumeric characters, or manipulate the image parameter to an array or string, which results in an err...

CVE-2014-8708

Pluck CMS 4.7.2 is affected. A remote attacker can execute arbitrary code via the blog form feature, as reported by multiple sources (NVD/CNVD equivalents). Root cause details are not explicitly described in the provided documents beyond the blog form vector. No remediation or patch information i...

Pluck CMS 4.7.3 Add-Page Cross Site Request Forgery

Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery Exploit Author: Ahsan Tahir Date: 18-10-2016 Software Link: http://www.pluck-cms.org/?file=download Vendor: http://www.pluck-cms.org/ Google Dork: "2005-2016. pluck is available" Contact: https://twitter.com/AhsanTahirAT |...

Pluck CMS 4.7.3 - Cross-Site Request Forgery (Add Page)

Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery Exploit Author: Ahsan Tahir Date: 18-10-2016 Software Link: http://www.pluck-cms.org/?file=download Vendor: http://www.pluck-cms.org/ Google Dork: "2005-2016. pluck is available" Contact: https://twitter.com/AhsanTahirAT |...

Pluck CMS 4.7.3 - Cross-Site Request Forgery (Add Page)

Pluck CMS 4.7.3 - Cross-Site Request Forgery Add Page Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery Exploit Author: Ahsan Tahir Date: 18-10-2016 Software Link: http://www.pluck-cms.org/?file=download Vendor: http://www.pluck-cms.org/ Google Dork: "2005-2016. pluck is...

Pluck 4.7.3 - (Delete Files) CSRF Vulnerability

Exploit for php platform in category web applications Document Title: =============== Pluck 4.7.3 - Delete Files CSRF Vulnerability Release Date: ============= 2016-10-12 Vulnerability Disclosure Timeline: ================================== 2016-10-12 : Discovery of the Vulnerability 2016-10-12 :...

Pluck 4.7.3 - (Delete File) CSRF Web Vulnerability

Document Title: =============== Pluck 4.7.3 - Delete File CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1980 Release Date: ============= 2016-10-17 Vulnerability Laboratory ID VL-ID: ==================================== 1980...

Pluck 4.7.3 - (Delete File) CSRF Web Vulnerability

Document Title: =============== Pluck 4.7.3 - Delete File CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1980 Release Date: ============= 2016-10-16 Vulnerability Laboratory ID VL-ID: ==================================== 1980...

Pluck 4.7.3 Delete Files Cross Site Request Forgery

i?Document Title: =============== Pluck 4.7.3 - Delete Files CSRF Vulnerability Release Date: ============= 2016-10-12 Vulnerability Disclosure Timeline: ================================== 2016-10-12 : Discovery of the Vulnerability 2016-10-12 : Contact the Vendor No Respose 2016-10-17 : Public...

Pluck 4.7.3 - Multiple vulnerabilities

Pluck CMS version 4.7.3 suffers from code execution, cross site request forgery, cross site scripting, and local file inclusion vulnerabilities. Title: Pluck 4.7.3 - Multiple vulnerabilities Date: 28.08.15 Vendor: pluck-cms.org Affected versions: = 4.7.3 current Tested on: Apache2.2 / PHP5 / Deb3...