Pluck-CMS-Stored-XSS---Installation

Pluck CMS 4.7.18 Stored XSS Author: Sergio Description: Multiple Cross-Site Scripting XSS vulnerabilities in installation of PluckCMS v.4.7.18 allows a local attacker to execute arbitrary code via a crafted payload injected into the cont1 and cont2 parameters in the installation process- Website...

CVE-2023-50564

CVE-2023-50564 📌 Descripción Este exploit permite a un administrador autenticado en Pluck CMS v4.7.18 cargar un módulo ZIP malicioso que contiene un shell PHP, resultando en ejecución remota de código RCE. ⚙️ Características Autentica en el objetivo usando un nombre de usuario y contraseña válidos...

CVE-2023-50564-pluck

CVE-2023-50564-pluck CVE-2023-50564 An arbitrary file upload vulnerability in the component /inc/modulesinstall.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file. This is an authenticated vulnerability. Disclaimer: This code is meant for...

CVE-2020-29607-POC

Pluck CMS 4.7.13 File Upload RCE Exploit 🚨 Educational Remote Code Execution Exploit 🚨 Author: Ron Jost Hacker5preme Reference: Exploit-DB CVE: CVE-2020-29607 ⚠️ Disclaimer: This script is for educational and authorized testing purposes only. Do not use it on systems you do not own or have explici...

CVE-2023-50564_Pluck-v4.7.18_PoC

CVE-2023-50564 PoC Este repositorio contiene una Prueba de Concepto para la vulnerabilidad CVE-2023-50564 en Pluck CMS versión 4.7.18 Descripción CVE-2023-50564 es una vulnerabilidad que permite la subida no autorizada de archivos en Pluck CMS versión 4.7.18. Este exploit aprovecha una falla en l...

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated--POC

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated-POC Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 CVE: CVE-2022-26965 About this: This script uploads shell.tar to the PluckCMS. An application will untar the package...

Pluck-Exploitation-by-skdevils

Pluck-Exploitation-by-skdevils Exploit Title: Pluck CMS 4.7.16 - Remote Code Execution RCE Authenticated Date: 13.03.2022 Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 Tested on Ubuntu 20.04.3 LTS CVE: CVE-2022-26965...

CVE-2020-29607

CVE-2020-29607-Exploit Exploit Title: Pluck CMS 4.7.13 - File Upload Remote Code Execution Authenticated CVE description: A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality,...

CVE-2023-50564

CVE-2023-50564 - Exploit de Pluck CMS v4.7.18 Resumen Este script explota una vulnerabilidad de subida arbitraria de archivos autenticada en Pluck CMS v4.7.18 CVE-2023-50564. Al aprovechar esta vulnerabilidad, un atacante autenticado puede subir un archivo PHP malicioso, permitiendo la ejecución ...

CVE-2026-70376

CVE-2026-70376 — Pluck CMS Site-wide CSRF → RCE Fail-open Referer check + no CSRF tokens + double-extension upload A single admin page-visit deletes content, injects pages, and drops a webshell At a glance · · · · · ·...

CVE-2026-38192

pluck-CMS-4.7.20-code-injection-vulnerability In admin.php, the moduleaddtosite function iterates through the entire $POST array, splits the user-controllable parameter names using explode'|', ... and directly concatenates them into data/settings/themes//moduleconf.php. This file will subsequentl...

CVE-2018-11736

CVE-2018-11736 PHP RCE Exploit Pluck CMS Disclaimer ⚠️: This exploit was developed in Rust primarily as an introductory programming learning exercise. Please excuse any lack of technical rigor or non-idiomatic code patterns. Also, this is not my discovery; I relied on official reports to write thi...

CVE-2023-50564

CVE-2023-50564 CVE-2023-50564 es una vulnerabilidad de ejecución remota de código RCE en Pluck CMS v4.7.18. Es posible gracias a una vulnerabilidad de carga arbitraria de archivos en el componente /inc/modulesinstall.php, que permite ejecutar código arbitrario subiendo un archivo .zip malicioso...

CVE-2020-29607

Alienfader Exploit / Alien@shell Webshell Upload Exploit Descripción: Este script de Python explota una vulnerabilidad de omisión de restricción de carga de archivos en Pluck CMS por ejemplo, versiones anteriores a la 4.7.13 para cargar un webshell PHP. Una vez cargado, el shell llamado...

Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564

CVE-2023-50564 - Pluck CMS v4.7.18 Exploit de Ejecución Remota de Código RCE Descripción Este script explota una vulnerabilidad de Ejecución Remota de Código RCE en Pluck CMS v4.7.18. La vulnerabilidad permite a un usuario malintencionado subir un archivo PHP malicioso al servidor y ejecutarlo,...

CVE-2020-29607-Pluck-CMS-4.7.13-Authenticated-File-Upload-RCE-PoC

CVE-2020-29607 — Pluck CMS Authenticated remote code execution in Pluck CMS before 4.7.13. The admin file manager admin.php?action=files does not validate file extensions, allowing upload of .phar files which Apache executes as PHP. Uploading a webshell through this endpoint results in RCE as the...

-Pluck-CMS-RCE-CVE-2023-50564

exploit.py 🐍💥 ⚠️ Aviso legal / ético: este script es solo para entornos autorizados ✅ CTFs, laboratorios, pentesting con permiso. No lo uses contra sistemas sin autorización ❌. 🧾 ¿Qué hace este script? exploitgreenhorn.py automatiza una cadena de explotación típica en un panel web: ✅ Hace login en...

CVE-2026-70376 Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area...

CVE-2026-70376

Pluck CMS has a CSRF risk in the admin panel due to relying solely on Referer-based checks (requestedByTheSameDomain()) with no per-request anti-CSRF token. If Referer/Host is missing, the code treats the request as same-origin, enabling a cross-site attacker page to request forged admin actions....

EUVD-2026-53192

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...