CVE-2019-1010062

Summary: CVE-2019-1010062 affects PluckCMS 4.7.4 and earlier. The vulnerability is CWE-434: Unrestricted Upload of File with Dangerous Type, enabling potential webshell access. The issue is traced to data/inc/images.php at line 36, with the attack vector described as manipulating the MIME TYPE in...

CVE-2020-20718

CVE-2020-20718 affects PluckCMS v4.7.10 development versions, where uploading a crafted image to the save_file() parameter permits remote code execution. Reported as a high-severity, network-exploitable flaw (CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; 9.8). Public details consistently describ...