533 matches found
CVE-2019-9050
An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code by using action=installmodule to upload a ZIP archive, which is then extracted and executed...
Cross site request forgery (csrf)
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=moduledelete&var1= URI...
Cross site request forgery (csrf)
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...
CVE-2019-9050
An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code by using action=installmodule to upload a ZIP archive, which is then extracted and executed...
CVE-2019-9049
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=moduledelete&var1= URI...
CVE-2019-9048
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme aka topic via a /admin.php?action=themedelete&var1= URI...
CVE-2019-9052
Pluck CMS 4.7.9-dev1 is affected by a CSRF vulnerability that enables an attacker to delete images via the URI /admin.php?action=deleteimage&var1=. This is documented across multiple sources (e.g., CVE-2019-9052, CNVD-2019-05783) indicating an unauthenticated or cross-site request scenario where ...
CVE-2019-9049
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=moduledelete&var1= URI...
CVE-2019-9052
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI...
CVE-2019-9050
An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code by using action=installmodule to upload a ZIP archive, which is then extracted and executed...
CVE-2019-9051
The CVE-2019-9051 entry concerns Pluck CMS 4.7.9-dev1 and describes a CSRF vulnerability that enables deleting articles via the URI /admin.php?action=deletepage&var1=. Public sources in connected documents (CNVD-2019-05782, OSV/NVD entries) confirm the vulnerable component as Pluck 4.7.9-dev1 and...
CVE-2019-9048
CVE-2019-9048 affects Pluck CMS (reported for version 4.7.9-dev1). The vulnerability is a Cross-Site Request Forgery (CSRF) that allows an attacker to delete a theme (topic) via /admin.php?action=theme_delete&var1=. The description confirms the underlying flaw is CSRF; no additional exploitation ...
CVE-2019-9051
An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI...
CVE-2019-9049
CVE-2019-9049 affects Pluck 4.7.9-dev1. The issue is a CSRF vulnerability that allows deletion of modules via the URI /admin.php?action=module_delete&var1=, as described across NVD/CNVD/OSV records. The connected documents consistently identify the vulnerable component and the underlying action, ...
CVE-2019-9050
Pluck 4.7.9-dev1 is vulnerable to arbitrary code execution via the ZIP upload path using action=installmodule, where the uploaded ZIP is extracted and its contents executed. The issue is documented across CVE-2019-9050 entries (NVD/CVE, CNVD, OSV, CVE List) and related records, all indicating adm...
Pluck cross-site scripting vulnerability (CNVD-2018-25042)
Pluck is a simple content management system CMS written in PHP. A cross-site scripting vulnerability exists in Pluck version 4.7.7. A remote attacker can exploit this vulnerability by sending the 'title' field to the admin.php?action=editpage&page=14253123 URL to execute malicious script...
Pluck Cross-Site Request Forgery Vulnerability
Pluck is a simple content management system CMS written in PHP. A cross-site request forgery vulnerability exists in Pluck version 4.7.7. A remote attacker can exploit this vulnerability to perform unauthorized actions e.g., changing the site name and email parameters with the help of the...
Cross site request forgery (csrf)
Pluck v4.7.7 allows CSRF via admin.php?action=settings...