Pluck Security Vulnerabilities and Issues — Pluck CVE List

Lucene search

Pluck-cmsPluck

2 matches found

CVE•added 2022/03/30 12:15 a.m.•101 views

CVE-2022-27432

A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.

8.8CVSS8.8AI score0.00129EPSS

CVE•added 2022/03/18 7:15 a.m.•94 views

CVE-2022-26965

In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.

7.2CVSS7.3AI score0.22714EPSS