Browse CVEs

HIGH 7.2 CVE-2025-46099 In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the mo… Pluck Mitigation only Fix from $1,9502025-07-23 CRITICAL 9.8 CVE-2024-43042 Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack. Pluck No fix yet Fix from $2,3002024-08-16 HIGH 8.8 CVE-2023-50564EPSS 29% An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via … Pluck No fix yet Fix from $1,9502023-12-14 MEDIUM 5.4 CVE-2023-5013 A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of … Pluck No fix yet Fix from $1,6002023-09-16 HIGH 7.2 CVE-2020-20919 File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the them… Pluck No fix yet Fix from $1,9502023-06-20 MEDIUM 6.5 CVE-2022-26589 A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. Pluck Mitigation only Fix from $1,6002022-04-13 HIGH 8.8 CVE-2022-27432 A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading… Pluck No fix yet Fix from $1,9502022-03-30 HIGH 7.2 CVE-2022-26965EPSS 36% In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution. Pluck No fix yet Fix from $1,9502022-03-18 HIGH 8.1 CVE-2021-27984 In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files. Pluck No fix yet Fix from $1,9502021-12-10 CRITICAL 9.8 CVE-2021-31746 Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and poten… Pluck No fix yet Fix from $2,3002021-12-10 HIGH 7.5 CVE-2021-31745 Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluc… Pluck No fix yet Fix from $1,9502021-12-10 CRITICAL 9.8 CVE-2020-20951 In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files. Pluck No fix yet Fix from $2,3002021-05-18 HIGH 8.8 CVE-2020-18195 Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the compone… Pluck No fix yet Fix from $1,9502021-05-17 HIGH 8.8 CVE-2020-18198 Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component … Pluck No fix yet Fix from $1,9502021-05-17 HIGH 8.8 CVE-2020-21564 An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin… Pluck No fix yet Fix from $1,9502020-09-30 CRITICAL 9.8 CVE-2019-11344 data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-p… Pluck No fix yet Fix from $2,3002019-04-19 HIGH 7.2 CVE-2019-9050 An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code by using action=installmodule to upload a ZIP archive… Pluck No fix yet Fix from $1,9502019-02-23 MEDIUM 6.5 CVE-2019-9048 An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme (aka topic) via a /admin.php?action=theme_delete&v… Pluck No fix yet Fix from $1,6002019-02-23 MEDIUM 6.5 CVE-2019-9049 An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=module_delete&var1= URI. Pluck No fix yet Fix from $1,6002019-02-23 MEDIUM 6.5 CVE-2019-9051 An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI. Pluck No fix yet Fix from $1,6002019-02-23 MEDIUM 6.5 CVE-2019-9052 An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI. Pluck No fix yet Fix from $1,6002019-02-23 HIGH 8.8 CVE-2018-16634 Pluck v4.7.7 allows CSRF via admin.php?action=settings. Pluck No fix yet Fix from $1,9502018-12-04 MEDIUM 5.4 CVE-2018-16633 Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title. Pluck No fix yet Fix from $1,6002018-12-04 MEDIUM 5.4 CVE-2018-16729 Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files. Pluck No fix yet Fix from $1,6002018-09-12 CRITICAL 9.8 CVE-2014-8708 Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature. Pluck No fix yet Fix from $2,3002017-03-17 MEDIUM 5.4 CVE-2014-8707 Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via t… Pluck No fix yet Fix from $1,6002017-03-17 MEDIUM 5.3 CVE-2014-8706 Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to… Pluck No fix yet Fix from $1,6002017-03-17 MEDIUM 6.8 CVE-2012-1227 Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins fo… Pluck No fix yet Fix from $1,6002012-02-21 MEDIUM 6.8 CVE-2008-6842 Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary … Pluck No fix yet Fix from $1,6002009-07-02 MEDIUM 6.8 CVE-2009-1765EPSS 15% Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to include and execute arbitrar… Pluck No fix yet Fix from $1,6002009-05-22