CVE-2020-24740: Cross-Site Request Forgery (CSRF)

An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage...

Pluck cross-site scripting vulnerability (CNVD-2018-25042)

Pluck is a simple content management system CMS written in PHP. A cross-site scripting vulnerability exists in Pluck version 4.7.7. A remote attacker can exploit this vulnerability by sending the 'title' field to the admin.php?action=editpage&page=14253123 URL to execute malicious script...

Design/Logic Flaw

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

CVE-2018-16633

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

PT-2018-13660

Name of the Vulnerable Software and Affected Versions Pluck version 4.7.7 Description The issue allows for XSS via the admin.php?action=editpage&page= endpoint, specifically the page parameter. This can be exploited by manipulating the page title. Recommendations For Pluck version 4.7.7, consider...

CVE-2018-16633: Improper Neutralization of Input During Web Page Generation

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

CVE-2012-1227

Multiple cross-site request forgery CSRF vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins for requests that 1 modify the admin email address or 2 modify the blog title via a settings action; 3 add a page via an editpage action, or 4 add a...

CVE-2011-5025

Multiple cross-site scripting XSS vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via 1 the tag parameter to editTag.yaws, 2 the index parameter to showOldPage.yaws, 3 the node parameter to allRefsToMe.yaws, or 4 the text paramete...

CVE-2009-4106: Improper Input Validation

Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers to inject and execute arbitrary PHP code via the filename and text parameters...