507 matches found
CVE-2019-9051
The CVE-2019-9051 entry concerns Pluck CMS 4.7.9-dev1 and describes a CSRF vulnerability that enables deleting articles via the URI /admin.php?action=deletepage&var1=. Public sources in connected documents (CNVD-2019-05782, OSV/NVD entries) confirm the vulnerable component as Pluck 4.7.9-dev1 and...
CVE-2019-9048
CVE-2019-9048 affects Pluck CMS (reported for version 4.7.9-dev1). The vulnerability is a Cross-Site Request Forgery (CSRF) that allows an attacker to delete a theme (topic) via /admin.php?action=theme_delete&var1=. The description confirms the underlying flaw is CSRF; no additional exploitation ...
CVE-2019-9052
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...
CVE-2019-9050
An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code by using action=installmodule to upload a ZIP archive, which is then extracted and executed...
CVE-2019-9050
Pluck 4.7.9-dev1 is vulnerable to arbitrary code execution via the ZIP upload path using action=installmodule, where the uploaded ZIP is extracted and its contents executed. The issue is documented across CVE-2019-9050 entries (NVD/CVE, CNVD, OSV, CVE List) and related records, all indicating adm...
CVE-2019-9049
CVE-2019-9049 affects Pluck 4.7.9-dev1. The issue is a CSRF vulnerability that allows deletion of modules via the URI /admin.php?action=module_delete&var1=, as described across NVD/CNVD/OSV records. The connected documents consistently identify the vulnerable component and the underlying action, ...
CVE-2019-9051
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI...
CVE-2019-9049
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=moduledelete&var1= URI...
CVE-2019-9048
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme aka topic via a /admin.php?action=themedelete&var1= URI...
Pluck cross-site scripting vulnerability (CNVD-2018-25042)
Pluck is a simple content management system CMS written in PHP. A cross-site scripting vulnerability exists in Pluck version 4.7.7. A remote attacker can exploit this vulnerability by sending the 'title' field to the admin.php?action=editpage&page=14253123 URL to execute malicious script...
Pluck Cross-Site Request Forgery Vulnerability
Pluck is a simple content management system CMS written in PHP. A cross-site request forgery vulnerability exists in Pluck version 4.7.7. A remote attacker can exploit this vulnerability to perform unauthorized actions e.g., changing the site name and email parameters with the help of the...
CVE-2018-16634
Pluck v4.7.7 allows CSRF via admin.php?action=settings...
Design/Logic Flaw
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...
Cross site request forgery (csrf)
Pluck v4.7.7 allows CSRF via admin.php?action=settings...
CVE-2018-16633
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...
CVE-2018-16634
Pluck v4.7.7 allows CSRF via admin.php?action=settings...
CVE-2018-16633
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...
CVE-2018-16633
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...
CVE-2018-16634
The vulnerability CVE-2018-16634 affects the Pluck CMS v4.7.7. A Cross-Site Request Forgery (CSRF) exists that allows an attacker to perform unauthorized actions via admin.php?action=settings, such as changing site name and email parameters. This is documented in CNVD-2018-25041 (Pluck CSRF vulne...