CVE-2018-16633

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

PT-2018-13660

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for XSS via the admin.php?action=editpage&page= endpoint, specifically the page parameter. This can be exploited by manipulating the page title. Recommendations For Pluck version 4.7.7, consider...

CVE-2018-16634: Cross-Site Request Forgery (CSRF)

Pluck v4.7.7 allows CSRF via admin.php?action=settings...

PT-2018-13661

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for CSRF via the admin.php?action=settings endpoint. This can potentially be exploited by tricking an administrator into performing unintended actions. Recommendations For Pluck version 4.7.7,...

CVE-2018-16729

Pluck CMS 4.7.7 is vulnerable to cross-site scripting via an SVG file containing Javascript in a SCRIPT element, uploaded through pages->manage under admin.php?action=files. The flaw is caused by how SVGs are handled, enabling XSS. Exploitation details are not provided in the documents; no pat...

PT-2018-13706

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for XSS Cross-Site Scripting attacks via an SVG file containing Javascript in a SCRIPT element. This file can be uploaded through the 'pages-manage' section under the 'admin.php?action=files'...