CVE-2008-3574

CVE-2008-3574 describes multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2 when register_globals is enabled. Attackers can inject arbitrary script/HTML via numerous parameters across data/inc/footer.php, data/inc/header.php, data/inc/header2.php, and data/inc/themeinstall.php (e.g...

CVE-2008-3574: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Pluck 4.5.2, when registerglobals is enabled, allow remote attackers to inject arbitrary web script or HTML via the 1 langfooter parameter to a data/inc/footer.php; the 2 pluckversion, 3 langinstall22, 4 titelkop, 5 langkop1, 6 langkop2, 7...

Pluck 4.5.2 Multiple Cross Site Scripting Vulnerabilities

---------------------------------------------------------------- Script : Pluck 4.5.2 Type : Multiple Cross Site Scripting Vulnerabilities Alert : Medium ---------------------------------------------------------------- Download From : http://www.pluck-cms.org/downloads/pluck-452.tar.gz...

Pluck CMS 4.5.2 - Multiple Cross-Site Scripting Vulnerabilities

Pluck CMS 4.5.2 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/30542/info Pluck is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute...

Pluck CMS 4.5.2 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/30542/info Pluck is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

pluck-xss.txt

---------------------------------------------------------------- Script : Pluck 4.5.2 Type : Multiple Cross Site Scripting Vulnerabilities Alert : Medium ---------------------------------------------------------------- Download From : http://www.pluck-cms.org/downloads/pluck-452.tar.gz...

CVE-2008-3194

Multiple directory traversal vulnerabilities in data/inc/themes/predefinedvariables.php in pluck 4.5.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 langpref, 2 file, 3 blogpost, or 4 cat parameter...

CVE-2008-3194

Pluck CMS 4.5.1 contains directory traversal vulnerabilities in data/inc/themes/predefined_variables.php that allow remote attackers to include and execute local files via a .. in the langpref, file, blogpost, or cat parameters. This is triggered by the affected file path handling and is related ...

CVE-2008-3194: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in data/inc/themes/predefinedvariables.php in pluck 4.5.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the 1 langpref, 2 file, 3 blogpost, or 4 cat parameter...

Pluck 4.5.1 (blogpost) Local File Inclusion Vulnerability (win only)

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: Pluck Local File inclusion Vendor: http://www.pluck-cms.org Bug: Local File Inclusion Vulnerable Version: 4.5.1 prior versions also may be affected Exploitation: Remote with browser Fix: N/A - Description:...

pluck-lfi.txt

www.BugReport.ir AmnPardaz Security Research Team Title: Pluck Local File inclusion Vendor: http://www.pluck-cms.org Bug: Local File Inclusion Vulnerable Version: 4.5.1 prior versions also may be affected Exploitation: Remote with browser Fix: N/A - Description: Pluck is a content management...

Pluck Local File inclusion

www.BugReport.ir AmnPardaz Security Research Team Title: Pluck Local File inclusion Vendor: http://www.pluck-cms.org Bug: Local File Inclusion Vulnerable Version: 4.5.1 prior versions also may be affected Exploitation: Remote with browser Fix: N/A - Description: Pluck is a content management...

Pluck CMS 4.5.1 (Windows) - 'blogpost' Local File Inclusion

www.BugReport.ir AmnPardaz Security Research Team Title: Pluck Local File inclusion Vendor: http://www.pluck-cms.org Bug: Local File Inclusion Vulnerable Version: 4.5.1 prior versions also may be affected Exploitation: Remote with browser Fix: N/A - Description: Pluck is a content management...

Pluck CMS 4.5.1 (Windows) - blogpost Local File Inclusion

Pluck CMS 4.5.1 Windows - blogpost Local File Inclusion www.BugReport.ir AmnPardaz Security Research Team Title: Pluck Local File inclusion Vendor: http://www.pluck-cms.org Bug: Local File Inclusion Vulnerable Version: 4.5.1 prior versions also may be affected Exploitation: Remote with browser Fi...

Pluck 4.5.1 (blogpost) Local File Inclusion Vulnerability (win only)

Exploit for unknown platform in category web applications ==================================================================== Pluck 4.5.1 blogpost Local File Inclusion Vulnerability win only ==================================================================== AmnPardaz Security Research Team...

Remote file inclusion

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: A reliable third party disputes this vulnerability because the applicable include is within a...

Directory traversal

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to read arbitrary local files via a .. dot dot in the file parameter. NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argume...

CVE-2007-4180

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to read arbitrary local files via a .. dot dot in the file parameter. NOTE: CVE and a reliable third party dispute this vulnerability because the code uses a fixed argume...

CVE-2007-4181

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: A reliable third party disputes this vulnerability because the applicable include is within a...

CVE-2007-4181

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter. NOTE: A reliable third party disputes this vulnerability because the applicable include is within a...