CVE-2018-16634

Pluck v4.7.7 allows CSRF via admin.php?action=settings...

Design/Logic Flaw

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

CVE-2018-16633

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

CVE-2018-16633

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title...

CVE-2018-16634

The vulnerability CVE-2018-16634 affects the Pluck CMS v4.7.7. A Cross-Site Request Forgery (CSRF) exists that allows an attacker to perform unauthorized actions via admin.php?action=settings, such as changing site name and email parameters. This is documented in CNVD-2018-25041 (Pluck CSRF vulne...

CVE-2018-16633

Pluck v4.7.7 contains a cross-site scripting (XSS) vulnerability that can be triggered via the page title when editing a page (admin.php?action=editpage&page=...). The underlying issue is a lack of proper sanitization/escaping for the title parameter, enabling injection of malicious scripts. The ...

CVE-2018-16634

Pluck v4.7.7 allows CSRF via admin.php?action=settings...

Pluck Cross-Site Scripting Vulnerability

Pluck is a simple content management system CMS written in PHP. A cross-site scripting vulnerability exists in Pluck version 4.7.7, which can be exploited by remote attackers to execute scripts via SVG files with Javascript code in the SCRIPT element...

CVE-2018-16729

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

CVE-2018-16729

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

Cross site scripting

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

CVE-2018-16729

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages-manage under admin.php?action=files...

CVE-2018-16729

Pluck CMS 4.7.7 is vulnerable to cross-site scripting via an SVG file containing Javascript in a SCRIPT element, uploaded through pages->manage under admin.php?action=files. The flaw is caused by how SVGs are handled, enabling XSS. Exploitation details are not provided in the documents; no pat...

CVE-2018-11736

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file...

Design/Logic Flaw

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file...

CVE-2018-11736

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file...

CVE-2018-11736

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file...

CVE-2018-11736

Pluck before 4.7.7-dev2 is affected by a remote code execution in /data/inc/images.php. An attacker can upload an image/jpeg/.htaccess file to execute arbitrary PHP code, leading to full compromise of affected hosts. The issue is mitigated by upgrading to Pluck 4.7.7-dev2 or applying the fixed re...

Pluck PHP Code Upload and Execution Vulnerability

Pluck is a simple content management system CMS written in PHP. A security vulnerability exists in the /data/inc/images.php file in Pluck versions prior to 4.7.7-dev2. A remote attacker can exploit this vulnerability by uploading an image/jpeg type .htaccess file to upload and execute arbitrary P...

Pluck Cross-Site Scripting Vulnerability

pluk is a simple content management system CMS written in PHP. A security vulnerability exists in versions prior to pluck 4.7.6, which stems from the program failing to properly restrict the character set for filenames. A remote attacker can exploit this vulnerability to inject arbitrary web scri...