507 matches found
CVE-2018-11330
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted...
CVE-2018-11331
Pluck CMS before 4.7.6 is affected: the upload restrictions do not cover certain filetypes (e.g., .phtml, .htaccess), enabling remote PHP code execution. Affected: Pluck before 4.7.6. Root cause: incomplete disallowed-filetypes list. Impact: remote code execution with potential high impact as per...
CVE-2018-11330
Pluck CMS (before 4.7.6) is affected by an authenticated stored XSS vulnerability due to improper restriction of the character set for filenames. This is consistently reported across CVE-2018-11330 entries in NVD, Red Hat, CNVD, OSV, and related records. No exploit details or remediation version ...
CVE-2018-11331
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess...
CVE-2018-11330
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted...
CVE-2018-7197
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting XSS vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL...
Cross site scripting
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting XSS vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL...
CVE-2018-7197
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting XSS vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL...
CVE-2018-7197
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting XSS vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL...
CVE-2018-7197
CVE-2018-7197 affects Pluck up to version 4.7.4. It is a stored XSS vulnerability in the admin/blog Reaction Comments path that allows remote, unauthenticated users to inject arbitrary web script or HTML via a crafted URL. The connected documents confirm the issue and its exploitation vector but ...
Pluck CMS 4.7.4 Cross Site Request Forgery
============================================== Exploit Title : pluck-cms vulnerability CSRF Reported Date : 8 - 10 - 2017 Exploit Author : Ashiyane Digital Security Team CWE: CSRF - 352 Tested On : kali Linux Vendor Homepage : https://www.pluck-cms.org/ Software Link :...
Pluck CMS Arbitrary Code Execution Vulnerability
Pluck CMS is a content management system CMS written in php. An arbitrary code execution vulnerability exists in Pluck CMS version 4.7.2. A remote attacker can exploit this vulnerability to execute arbitrary code via the log form feature...
Pluck CMS TinyMCE Cross-Site Scripting Vulnerability
Pluck CMS is a content management system CMS written in php.TinyMCE is one of the browser-based visual HTML editors. A cross-site scripting vulnerability exists in TinyMCE in Pluck CMS version 4.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...
Pluck CMS Information Disclosure Vulnerability
Pluck CMS is a content management system CMS written in php. An information disclosure vulnerability exists in Pluck CMS version 4.7.2. A remote attacker can exploit this vulnerability to obtain sensitive information...
Design/Logic Flaw
Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature...
CVE-2014-8707
Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...
Cross site scripting
Cross-site scripting XSS vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option...
CVE-2014-8706
Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...
Code injection
Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by 1 changing "PHPSESSID" to an array; 2 adding non-alphanumeric chars to "PHPSESSID"; 3 changing the image parameter to an array; or 4 changing the image parameter to a string, which reveals the installation path in an error...