CVE-2008-7090

CVE-2008-7090 affects Pligg 9.9 and earlier. Two directory traversal flaws allow remote attackers to (1) check existence of arbitrary files via .. in trackback.php ($tb_url) and (2) include arbitrary files via .. in the template parameter to settemplate.php. Impact per sources: potential file dis...

CVE-2023-37677

CVE-2023-37677 affects Pligg CMS v2.0.2 (aka Kliqqi) and is a remote code execution vulnerability in the admin_editor.php component. The NVD entry provides a CVSSv3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a high-severity, unauthenticated, network-exploitable issue wi...

CVE-2009-4786

Pligg before version 1.0.3 is vulnerable to multiple cross-site scripting (XSS) flaws via the HTTP Referer header in eight endpoints (admin_config.php, admin_modules.php, delete.php, editlink.php, submit.php, submit_groups.php, user_add_remove_links.php, user_settings.php). The issue allows remot...

CVE-2008-5739

CVE-2008-5739 : A SQL injection vulnerability exists in Pligg CMS 9.9.5 Beta, specifically in evb/check_url.php, where the url parameter is used in database queries without sufficient sanitization. This allows remote attackers to execute arbitrary SQL commands, potentially leading to data disclos...

CVE-2022-34956

Pligg CMS v2.0.2 is affected by a time-based SQL injection via the page_size parameter in load_data_for_groups.php (CVE-2022-34956). The vulnerability allows an attacker to manipulate SQL queries, with the NVD listing a 9.8 (CRITICAL) base score across confidentiality, integrity, and availability...

CVE-2022-34955

CVE-2022-34955 : Pligg CMS v2.0.2 contains a time-based SQL injection vulnerability exposed via the page_size parameter in load_data_for_topusers.php. The issue is documented across multiple feeds (NVD, Red Hat, OSV, CVE lists) with a common description and an NVD CVSS v3.1 base score of 9.8 (CRI...

CVE-2015-6655

CVE-2015-6655 affects Pligg CMS 2.0.2. A Cross-Site Request Forgery in admin/admin_users.php lets an attacker add an administrator by forging requests, hijacking admin authentication. Public-facing details show PoCs/exploits (e.g., Exploit-DB entry) demonstrating/add-admin CSRF behavior. The avai...

CVE-2024-42613

Pligg CMS v2.0.2 contains a CSRF vulnerability in /admin/admin_widgets.php?action=install&widget=akismet. Root cause: the request is not adequately verified as coming from a trusted user (CNVD/Red Hat entries describe insufficient verification). Impact is high (CVE-2024-42613 CVSS 8.8) with poten...

CVE-2024-42612

Pligg CMS v2.0.2 is affected by a CSRF vulnerability that can be triggered through /admin/domain_management.php?whitelist_add. The root cause is insufficient verification of the request origin trusted user, enabling an attacker to forge malicious actions. Documented impact includes the ability to...

CVE-2008-3366

CVE-2008-3366 is a SQL injection vulnerability affecting Pligg CMS Beta 9.9.0 where the id parameter in story.php can be exploited to execute arbitrary SQL commands. The issue is documented in multiple feeds (NVD/NIST entry and CVE records) and is potentially related to CVE-2008-1774 (editlink.ph...

CVE-2024-42611

Pligg CMS v2.0.2 contains a Cross-Site Request Forgery (CSRF) vulnerability exploitable via admin/admin_page.php?link_id=1&mode=delete. The issue arises because requests to that endpoint are not adequately verified as coming from a trusted user, enabling an attacker to forge malicious actions on ...

CVE-2024-42617

CVE-2024-42617 affects Pligg CMS v2.0.2 with a Cross-Site Request Forgery (CSRF) vulnerability in the admin API: /admin/admin_config.php?action=save&var_id=32. Multiple sources (including Red Hat and CNVD) corroborate the CSRF issue; an accompanying entry lists a potential PoC/exploitation path. ...

CVE-2024-42605

CVE-2024-42605 concerns Pligg CMS v2.0.2, with a Cross-Site Request Forgery (CSRF) that targets /admin/edit_page.php?link_id=1. The Red Hat/CNVD/NVD entries confirm the issue exists in Pligg CMS v2.0.2 and describe the vulnerability as CSRF without robust verification of the requester. PT-Securit...

CVE-2024-42606

Pligg CMS v2.0.2 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exploitable via the admin_log.php?clear=1 endpoint. Root cause: requests are not adequately verified as coming from trusted users, enabling forged operations on behalf of victims. Public descriptions across Red Hat,...

CVE-2009-4788

CVE-2009-4788 concerns multiple open redirect vulnerabilities in Pligg 1.0.2 and earlier . The issue allows remote attackers to redirect users to arbitrary sites and facilitate phishing via two vectors: the return parameter to pligg/login.php and the HTTP Referer header to user_settings.php . Thi...

CVE-2010-2577

Pligg CMS prior to version 1.1.1 contains multiple SQL injection vulnerabilities. Specifically, the title parameter in storyrss.php and story.php is unsafely handled, allowing remote attackers to execute arbitrary SQL commands. Root cause: improper input handling leads to SQL injection. Affected ...

CVE-2024-42616

Pligg CMS v2.0.2 is affected by a CSRF vulnerability exposed at /admin/admin_widgets.php?action=remove&widget=Statistics. The CVE-2024-42616 entry is supported by multiple feeds (NVD, OSV, CNVD, etc.) stating that the issue is a Cross-Site Request Forgery vulnerability in Pligg/Kliqqi CMS. The co...

CVE-2012-2436

Pligg CMS 1.2.1 is affected by multiple XSS vulnerabilities (CVE-2012-2436) due to insufficient sanitization of inputs in several parameters across admin and module PHP files. Specifically, vectorized input includes arbitrary GET parameters to /admin/admin_index.php (action=move/minimize), the ka...

CVE-2009-4787

Pligg CMS (before 1.0.3) is affected by multiple CSRF vulnerabilities that enable remote attackers to hijack administrator sessions for actions such as creating user accounts; additional OpenVAS/Nessus entries note related XSS/CSRF issues. The confirmed impact is administrative hijacking via CSRF...

CVE-2024-42608

Pligg CMS v2.0.2 is affected by a Cross-Site Request Forgery (CSRF) vulnerability on /admin/submit_page.php. The issue is described across multiple sources (NVD/Red Hat/CNVD/CNNVD) as CSRF in Pligg CMS, enabling a forged request to perform sensitive operations without adequate request verificatio...

CVE-2024-42610

Affected software: Pligg CMS v2.0.2. Vulnerability: Cross-Site Request Forgery (CSRF) via /admin/admin_backup.php?dobackup=files. The vulnerability stems from insufficient verification that requests originate from trusted users. Impact (as stated): An attacker can forge malicious requests to perf...

CVE-2024-42621

Affected software: Pligg CMS v2.0.2 (also referred to as Kliqqi CMS in related records). Vulnerability type & vector: Cross-Site Request Forgery (CSRF) via the /admin/admin_editor.php endpoint. Root cause: Insufficient verification of the request origin/authorization allows an attacker to forge r...

CVE-2024-42604

Pligg CMS v2.0.2 contains a CSRF vulnerability in the admin_group.php endpoint (mode=delete&group_id=3). The flaw arises from insufficient verification of the requesting user, allowing an attacker to forge state-changing requests. Several connected reports (including Red Hat, CNVD, CNVD CNVD, OSV...

CVE-2024-42619

Pligg CMS v2.0.2 contains a CSRF vulnerability in /admin/domain_management.php?id=0&list=whitelist&remove=pligg.com. The issue stems from insufficient verification, enabling forged requests to manipulate the whitelist. CVSSv3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (base 8.8, HIGH). Connect...

CVE-2012-2435

Pligg CMS (prior to 1.2.2) has a directory traversal / Local File Inclusion vulnerability in the captcha module (module.php) that allows remote authenticated users to include and execute local files via the captcha parameter, demonstrated as a CSRF-exploitation vector. The CVE entry CVE-2012-2435...

CVE-2024-42609

Pligg CMS v2.0.2 is affected by a CSRF vulnerability exposed via /admin/admin_backup.php?dobackup=avatars. The connected documents confirm the vulnerability type and affected version, but do not provide an official patch details within the supplied sources. Some sources (PT-2024-30061) mention a ...

CVE-2024-42618

CVE-2024-42618 affects Pligg CMS (also referred to as Kliqqi CMS) v2.0.2. The vulnerability is a Cross-Site Request Forgery (CSRF) that can be triggered via the endpoint /module.php?module=karma, allowing an attacker to forge a request on behalf of a logged-in user. No explicit exploit details ar...

CVE-2024-42603

Pligg CMS v2.0.2 (also referenced as Kliqqi CMS) contains a CSRF vulnerability exploitable via /admin/admin_backup.php?dobackup=clearall. The issue arises because the request is not adequately verified as originating from a trusted user, allowing an attacker to forge or induce sensitive operation...

CVE-2010-3013

CVE-2010-3013 is a SQL injection vulnerability in Pligg before 1.1.1, caused by unsafely handling the role parameter in groupadmin.php. The issue is exploitable remotely and allows an attacker to inject arbitrary SQL commands. This CVE is distinct from CVE-2010-2577. Connected sources confirm the...

CVE-2008-7089

Pligg 9.9 and earlier is affected by a Cross-site scripting (XSS) vulnerability. The flaw allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a search action to user.php and other unspecified vectors. Affected component: Pligg (versions up to 9.9 or earlier...

CVE-2008-7091

CVE-2008-7091 affects Pligg 9.9 and earlier, with multiple SQL injection vulnerabilities caused by improper handling of user-supplied input across several PHP scripts (vote.php, trackback.php, submit.php, story.php, recommend.php, cloud.php, out.php, login.php, cvote.php, edit.php). Attack vector...

CVE-2011-3986

CVE-2011-3986 is a cross-site scripting (XSS) vulnerability in Pligg before 1.2.0. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in Pligg CMS. Public references (NVD/Red Hat/JP VN DB) confirm Pligg CMS 1.1.x/older versions as affected, with CVSS-...

CVE-2014-9096

CVE-2014-9096 : In Pligg CMS

CVE-2024-42607

CVE-2024-42607 concerns Pligg CMS v2.0.2, where a Cross-Site Request Forgery (CSRF) vulnerability is exposed via the endpoint /admin/admin_backup.php?dobackup=database. The vulnerability description is consistently reported across multiple connected sources (e.g., Red Hat CVE, CNVD, NVD, OSV, CVE...

CVE-2008-6968

CVE-2008-6968 affects Pligg CMS 9.9.5. The vulnerability path is in submit.php, where multiple SQL injection flaws allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) id parameters. The NVD description explicitly states these parameters as injection vectors. Impa...

CVE-2011-5022

Summary: CVE-2011-5022 affects Pligg CMS 1.1.2, with an SQL injection in search.php via the status parameter. The root cause is improper handling of user-supplied input in the search functionality, enabling arbitrary SQL execution by remote attackers. Impact (as stated): Remote attackers can exec...

CVE-2012-2936

CVE-2012-2936 affects Pligg CMS prior to 1.2.2. The vulnerability is a set of cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary script/HTML via: (1) user or (2) page parameters to (a) admin/admin_comments.php or (b) admin/admin_links.php, or the list parameter in a ...

CVE-2011-3794

Pligg CMS 1.1.3 contains an information-disclosure vulnerability: remote attackers can obtain the installation path by requesting a PHP file directly, with an error message revealing the path (demonstrated by widgets/statistics/init.php and similar files). The affected component is a PHP file pat...

CVE-2007-5579

Pligg CMS 9.5 is affected by CVE-2007-5579 through login.php, where a guessable confirmation code enables password reset by an attacker knowing a username. The root cause is a predictable confirmationcode parameter used during forgotten-password flow, allowing an unauthorized password reset with ...

CVE-2011-5023

The CVE-2011-5023 entry concerns a Cross-site Scripting (XSS) vulnerability in Pligg CMS 1.1.4 triggered by PATH_INFO to the search program. Root cause: improper handling of PATH_INFO leads to script/HTML injection. Impact: remote attackers could inject arbitrary web scripts or HTML. Affected sof...

CVE-2008-1774

CVE-2008-1774 describes an SQL injection vulnerability in editlink.php of Pligg 9.9.0, allowing remote attackers to execute arbitrary SQL commands through the id parameter. This vulnerability is documented across multiple sources (NVD listing and related CVE entries) as enabling arbitrary SQL exe...

CVE-2008-3572

CVE-2008-3572 describes a cross-site scripting (XSS) vulnerability in the Pligg application (version 9.9.5) where the web parameter category in index.php can be manipulated to inject arbitrary script/HTML. The linked sources confirm the affected product/version and the input vector but do not pro...

CVE-2012-2937

CVE-2012-2937 affects Pligg CMS, prior to 1.2.2. The vulnerability is multiple SQL injection flaws in the core/admin and module code: (1) list parameter in move action to admin/admin_index.php, (2) display parameter in minimize action to admin/admin_index.php, (3) enabled[] parameter to admin/adm...