26 matches found
CVE-2020-37217: Cross-Site Request Forgery (CSRF)
Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the admin.php?action=adduser endpoint with POST requests...
CVE-2020-21564
An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...
CVE-2022-36261
An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&ctrl=del&path=/../../../test.txt...
CVE-2022-26965: Unrestricted Upload of File with Dangerous Type
In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution...
PT-2022-18145
Name of the Vulnerable Software and Affected Versions Pluck version 4.7.16 Description The issue allows an admin user to perform remote code execution using the theme upload functionality. This is achieved through the "/admin.php?action=themeinstall" endpoint. Recommendations For Pluck version...
CVE-2020-24740
An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage...
PT-2021-11069
Name of the Vulnerable Software and Affected Versions: Pluck version 4.7.10-dev2 Description: An issue was discovered that allows a CSRF vulnerability, enabling the editing of pages via the "/admin.php?action=editpage" API endpoint. This issue can potentially be exploited to modify pages without...
CVE-2020-24740: Cross-Site Request Forgery (CSRF)
An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage...
CVE-2020-18198: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."...
PT-2021-10154
Name of the Vulnerable Software and Affected Versions: Pluck CMS version 4.7.9 Description: The issue allows remote attackers to execute arbitrary code and delete a specific article via the component "/admin.php?action=page". This is a Cross Site Request Forgery CSRF issue. Recommendations: For...
PT-2021-10155
Name of the Vulnerable Software and Affected Versions: Pluck CMS version 4.7.9 Description: The issue allows remote attackers to execute arbitrary code and delete specific images via the component "/admin.php?action=images". This is a Cross Site Request Forgery CSRF issue. Recommendations: For...
CVE-2020-18195: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."...
CVE-2020-21564
CVE-2020-21564 concerns Pluck CMS versions 4.7.10-dev2 and 4.7.11, where a file upload vulnerability can lead to remote command execution via the endpoint admin.php?action=files. The sources provided describe the vulnerability but do not specify additional technical details, exploit status, affec...
CVE-2020-21564: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...
PT-2020-15374
Name of the Vulnerable Software and Affected Versions Pluck CMS versions 4.7.10-dev2 through 4.7.11 Description The issue is related to a file upload vulnerability that can lead to remote command execution. This can be achieved via the "admin.php?action=files" endpoint. The vulnerability allows f...
PT-2019-19334
Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description A CSRF issue allows deletion of modules via the "/admin.php?action=module delete&var1=" API endpoint, where var1 is a vulnerable parameter. This can be exploited to delete modules. Recommendations For Pluck...
PT-2019-19333
Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description A CSRF issue allows deletion of a theme via the "/admin.php?action=theme delete&var1=" API endpoint. Recommendations For Pluck version 4.7.9-dev1, as a temporary workaround, consider restricting access to t...
CVE-2019-9052: Cross-Site Request Forgery (CSRF)
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...
PT-2019-19337
Name of the Vulnerable Software and Affected Versions Pluck version 4.7.9-dev1 Description An issue was discovered that allows for a CSRF vulnerability, enabling the deletion of pictures via the "/admin.php?action=deleteimage&var1=" URI. Recommendations For Pluck version 4.7.9-dev1, consider...