Pluck 代码问题漏洞

Pluck is a content management system CMS developed using the PHP language. A code issue vulnerability exists in Pluck CMS version 4.7.16, which stems from a remote shell upload execution vulnerability in Pluck CMS version 4.7.16...

Pluck CMS 4.7.16 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Pluck CMS 4.7.16 - Remote Code Execution RCE Authenticated Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 Tested on Ubuntu 20.04.3 LTS CVE: CVE-2022-26965 Usage : python3 exploit.py Example: python3 exploit.py 127.0.0.1 80...

Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: Pluck CMS 4.7.16 - Remote Code Execution RCE Authenticated Date: 13.03.2022 Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 Tested on Ubuntu 20.04.3 LTS CVE: CVE-2022-26965 Usage : python3 exploit.py Example: python3 exploit.p...

Pluck Authorization Issues Vulnerabilities

Pluck is a content management system CMS developed using the PHP language. Pluck-CMS Pluck suffers from an authorization issue vulnerability that stems from a session repair vulnerability in login.php that allows an attacker to maintain unauthorized access to the platform. Since Pluck does not...

Pluck Path Traversal Vulnerability

Pluck is a content management system CMS developed using the PHP language. A security vulnerability exists in Pluck-CMS Pluck that stems from a Zip Slip vulnerability in Pluck-CMS Pluck version 4.7.15 that allows an attacker to upload specially crafted zip files, leading to directory traversal an...

Pluck Access Control Error Vulnerability

Pluck is a content management system CMS developed using the PHP language. an access control error vulnerability exists in Pluck-CMS Pluck, which stems from a missing SSL certificate validation issue in updateapplet.php, which could lead to a man-in-the-middle attack. No details of the...

CVE-2021-31745

Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation...

CVE-2021-31745

Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation...

CVE-2021-31746

Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arbitrary code execution...

CVE-2021-31745

Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation...

CVE-2021-31746

Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arbitrary code execution...

CVE-2021-31746

Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arbitrary code execution...

Session fixation

Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation...

Directory traversal

Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arbitrary code execution...

CVE-2021-31746

Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arbitrary code execution...

CVE-2021-31746

CVE-2021-31746 affects Pluck-CMS Pluck 4.7.15. The connected Red Hat, CNVD, OSV, NVD, CNVD and other records describe a Zip Slip vulnerability that allows uploading specially crafted zip files, causing directory traversal and potentially arbitrary code execution. The core details in the sources a...

CVE-2021-31745

CVE-2021-31745 affects Pluck-CMS (Pluck 4.7.15). A session-fixation vulnerability in login.php allows an attacker to sustain unauthorized access because prior sessions are not invalidated after a password change. The available documents describe the issue and do not specify a patch version or con...

CVE-2021-31745

Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular remediation...

Pluck 信任管理问题漏洞

Pluck is a content management system CMS developed using the PHP language. an access control error vulnerability exists in Pluck-CMS Pluck, which stems from a missing SSL certificate validation issue in updateapplet.php, which could lead to a man-in-the-middle attack. No details of the...

Pluck CMS suffers from a file upload vulnerability (CNVD-2021-40249)

Pluck CMS is a PHP-based content management system. Pluck CMS suffers from a file upload vulnerability that can be exploited by an attacker to upload a webshell and gain server privileges...