Pluck Cross-Site Scripting Vulnerability

pluk is a simple content management system CMS written in PHP. A security vulnerability exists in versions prior to pluck 4.7.6, which stems from the program failing to properly restrict the character set for filenames. A remote attacker can exploit this vulnerability to inject arbitrary web scri...

Pluck CMS 4.7.4 Cross Site Request Forgery

============================================== Exploit Title : pluck-cms vulnerability CSRF Reported Date : 8 - 10 - 2017 Exploit Author : Ashiyane Digital Security Team CWE: CSRF - 352 Tested On : kali Linux Vendor Homepage : https://www.pluck-cms.org/ Software Link :...

Pluck CMS Arbitrary Code Execution Vulnerability

Pluck CMS is a content management system CMS written in php. An arbitrary code execution vulnerability exists in Pluck CMS version 4.7.2. A remote attacker can exploit this vulnerability to execute arbitrary code via the log form feature...

Pluck CMS TinyMCE Cross-Site Scripting Vulnerability

Pluck CMS is a content management system CMS written in php.TinyMCE is one of the browser-based visual HTML editors. A cross-site scripting vulnerability exists in TinyMCE in Pluck CMS version 4.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross site scripting

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

CVE-2014-8706

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

CVE-2014-8708

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

Code injection

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

Design/Logic Flaw

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

CVE-2014-8707

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

CVE-2014-8707

Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...

CVE-2014-8706

Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...

CVE-2014-8706

CVE-2014-8706 affects Pluck CMS 4.7.2 and is an information disclosure issue. The vulnerability occurs when a remote attacker can cause PHPSESSID to be treated as an array or altered with non-alphanumeric characters, or manipulate the image parameter to an array or string, which results in an err...

CVE-2014-8708

Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...

CVE-2014-8708

Pluck CMS 4.7.2 is affected. A remote attacker can execute arbitrary code via the blog form feature, as reported by multiple sources (NVD/CNVD equivalents). Root cause details are not explicitly described in the provided documents beyond the blog form vector. No remediation or patch information i...

CVE-2014-8707

Summary: CVE-2014-8707 is a cross-site scripting (XSS) vulnerability in TinyMCE within Pluck CMS version 4.7.2. The flaw allows remote authenticated users to inject arbitrary script/HTML via the TinyMCE “edit HTML source” option. The connected CNVD entry for Pluck CMS confirms a TinyMCE XSS issue...

Pluck CMS 4.7.3 Add-Page Cross Site Request Forgery

Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery Exploit Author: Ahsan Tahir Date: 18-10-2016 Software Link: http://www.pluck-cms.org/?file=download Vendor: http://www.pluck-cms.org/ Google Dork: "2005-2016. pluck is available" Contact: https://twitter.com/AhsanTahirAT |...

Pluck CMS 4.7.3 - Cross-Site Request Forgery (Add Page)

Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery Exploit Author: Ahsan Tahir Date: 18-10-2016 Software Link: http://www.pluck-cms.org/?file=download Vendor: http://www.pluck-cms.org/ Google Dork: "2005-2016. pluck is available" Contact: https://twitter.com/AhsanTahirAT |...

Pluck CMS 4.7.3 - Cross-Site Request Forgery (Add Page)

Pluck CMS 4.7.3 - Cross-Site Request Forgery Add Page Exploit Title: Pluck CMS 4.7.3 - Add-Page Cross-Site Request Forgery Exploit Author: Ahsan Tahir Date: 18-10-2016 Software Link: http://www.pluck-cms.org/?file=download Vendor: http://www.pluck-cms.org/ Google Dork: "2005-2016. pluck is...

Pluck 4.7.3 - (Delete File) CSRF Web Vulnerability

Document Title: =============== Pluck 4.7.3 - Delete File CSRF Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1980 Release Date: ============= 2016-10-16 Vulnerability Laboratory ID VL-ID: ==================================== 1980...