Pluck CMS 4.7.18 Cross Site Scripting

Exploit Title: pluck v4.7.18 - Stored Cross-Site Scripting XSS Application: pluck Version: 4.7.18 Bugs: XSS Technology: PHP Vendor URL: https://github.com/pluck-cms/pluck Software Link: https://github.com/pluck-cms/pluck Date of found: 01-05-2023 Author: Mirabbas Ağalarov Tested on: Linux 2...

CVE-2023-25828

Pluck CMS is vulnerable to an authenticated remote code execution RCE vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a normalization process...

Design/Logic Flaw

Pluck CMS is vulnerable to an authenticated remote code execution RCE vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a normalization process...

CVE-2023-25828

Pluck CMS (authenticated) is vulnerable to remote code execution via the albums module. A lack of file extension validation allows uploading a crafted JPEG payload containing an embedded PHP web-shell, which an authenticated admin can access to achieve RCE on the web server. Affected: Pluck CMS a...

CVE-2023-25828 Authenticate Remote Code Execution in Pluck CMS

Pluck CMS is vulnerable to an authenticated remote code execution RCE vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a normalization process...

CVE-2023-25828 Authenticate Remote Code Execution in Pluck CMS

Pluck CMS is vulnerable to an authenticated remote code execution RCE vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a normalization process...

CVE-2023-25828 Authenticate Remote Code Execution in Pluck CMS

Pluck CMS is vulnerable to an authenticated remote code execution RCE vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a normalization process...

PT-2023-20333 · Pluck Cms · Pluck Cms

Name of the Vulnerable Software and Affected Versions: Pluck CMS affected versions not specified Description: The issue concerns an authenticated remote code execution RCE vulnerability through the "albums" module. This module allows the creation of image collections that can be inserted into web...

Pluck CMS 代码问题漏洞

Pluck is a content management system CMS developed using the PHP language. A security vulnerability exists in Pluck CMS that stems from a lack of validation of file extensions...

Authentication Remote Code Execution

Description Found authenticated Remote Code Execution RCE on pluck 4.7.15 While reading the source code found blacklisted extension are mentioned in the file data/inc/files.php at line 44 and 45. File upload function validating the file extension is match any one of the following extension .php,...

CVE-2022-26589

A Cross-Site Request Forgery CSRF in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages...

CVE-2022-26589

A Cross-Site Request Forgery CSRF in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages...

CVE-2022-26589

A Cross-Site Request Forgery CSRF in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages...

CVE-2022-26589

CVE-2022-26589 is a CSRF vulnerability in Pluck CMS v4.7.15 that allows an attacker to delete arbitrary pages. The issue is described across multiple feeds as a Cross-Site Request Forgery affecting Pluck CMS, with the core impact being unauthorized page deletion. The public records do not provide...

CVE-2022-26589

A Cross-Site Request Forgery CSRF in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages...

Pluck跨站请求伪造漏洞

Pluck is a content management system CMS developed using the PHP language. A security vulnerability exists in Pluck CMS v4.7.15 that allows an attacker to delete arbitrary pages...

CVE-2022-27432

A Cross-Site Request Forgery CSRF in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover...

CVE-2022-27432

A Cross-Site Request Forgery CSRF in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover...