CVE-2020-29607

CVE-2020-29607 affects Pluck CMS prior to 4.7.13, where a file upload restriction bypass in the admin “manage files” functionality allows an authenticated admin to upload a payload and trigger remote code execution. Public references show an authenticated file-upload RCE exploit for Pluck 4.7.13 ...

CVE-2020-29607

A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution...

Pluck Code Issue Vulnerability

Pluck is a Content Management System CMS developed in PHP. A code issue exists in Pluck CMS versions prior to 4.7.13, which stems from a file upload limit bypass vulnerability that allows a privileged administrator user to access the host computer via the "Manage Files" feature, which could lead ...

CVE-2020-21564

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

CVE-2020-21564

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

Unrestricted file upload

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

CVE-2020-21564

An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?action=files...

CVE-2020-21564

CVE-2020-21564 concerns Pluck CMS versions 4.7.10-dev2 and 4.7.11, where a file upload vulnerability can lead to remote command execution via the endpoint admin.php?action=files. The sources provided describe the vulnerability but do not specify additional technical details, exploit status, affec...

File Upload Vulnerability in Pluck CMS Backend

Pluck is a small and simple content management system written in php. A file upload vulnerability exists in the Pluck CMS backend, which can be exploited by attackers to gain server privileges...

Command execution vulnerability in Pluck-CMS th***.php file

Pluck is a very simple and easy to use CMS Content Management System for PHP platforms. A command execution vulnerability exists in the Pluck-CMS th.php file, which can be exploited by an attacker to obtain application control privileges to get a webshell...

Command Execution Vulnerability in Pluck-CMS

Pluck is a very simple and easy to use CMS Content Management System for PHP platforms. A command execution vulnerability exists in Pluck-CMS, which can be exploited by an attacker to execute remote code to gain privileges in a web application...

Command Execution Vulnerability in Pluck CMS

Pluck CMS is a content management system CMS written in php. Pluck CMS suffers from a command execution vulnerability that can be exploited by an attacker to gain control of the web server...

Pluck CMS suffers from a file upload vulnerability

Pluck CMS is a content management system CMS written in php. Pluck CMS suffers from a file upload vulnerability that can be exploited by an attacker to gain control of the web server...

Pluck Code Issue Vulnerability

Pluck is a content management system CMS developed using the PHP language. A code issue vulnerability exists in the data/inc/images.php file in Pluck 4.7.4 and earlier versions. The vulnerability stems from an improperly designed or implemented code development process for a web-based system or...

Code injection

data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked...

CVE-2019-11344

data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked...

CVE-2019-11344

data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked...

CVE-2019-11344

data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked...

CVE-2019-11344

CVE-2019-11344 affects Pluck 4.7.8 where data/inc/files.php allows remote code execution by uploading a .htaccess that sets SetHandler x-httpd-php for a .txt file, bypassing blocked PHP-related filename extensions. This is documented across multiple feeds (NVD, Red Hat, OSV, CVE lists). Root caus...

Pluck Cross-Site Request Forgery Vulnerability (CNVD-2019-05780)

Pluck is a content management system CMS developed using the PHP language. A cross-site request forgery vulnerability exists in Pluck version 4.7.9-dev1. A remote attacker can exploit this vulnerability by deleting modules with /admin.php?action=moduledelete&var1= URI...