CVE-2020-21564

CVE-2020-21564 concerns Pluck CMS versions 4.7.10-dev2 and 4.7.11, where a file upload vulnerability can lead to remote command execution via the endpoint admin.php?action=files. The sources provided describe the vulnerability but do not specify additional technical details, exploit status, affec...

CVE-2020-21564: Unrestricted Upload of File with Dangerous Type

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

PT-2020-15374

Name of the Vulnerable Software and Affected Versions Pluck CMS versions 4.7.10-dev2 through 4.7.11 Description The issue is related to a file upload vulnerability that can lead to remote command execution. This can be achieved via the "admin.php?action=files" endpoint. The vulnerability allows f...

CVE-2018-16729

Pluck CMS 4.7.7 is vulnerable to cross-site scripting via an SVG file containing Javascript in a SCRIPT element, uploaded through pages->manage under admin.php?action=files. The flaw is caused by how SVGs are handled, enabling XSS. Exploitation details are not provided in the documents; no pat...

PT-2018-13706

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for XSS Cross-Site Scripting attacks via an SVG file containing Javascript in a SCRIPT element. This file can be uploaded through the 'pages-manage' section under the 'admin.php?action=files'...