Browse CVEs

MEDIUM 5.4 CVE-2018-16729 Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files. Pluck No fix yet Fix from $1,6002018-09-12 CRITICAL 9.8 CVE-2018-11736EPSS 9% An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using th… Pluck after 4.7.7 Fix from $2,3002018-06-05 CRITICAL 9.8 CVE-2018-11331 An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing s… Pluck 4.7.6+ Fix from $2,3002018-05-21 MEDIUM 6.1 CVE-2018-7197 An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbit… Pluck after 4.7.4 Fix from $1,6002018-02-18 CRITICAL 9.8 CVE-2014-8708 Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature. Pluck No fix yet Fix from $2,3002017-03-17 MEDIUM 5.4 CVE-2014-8707 Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via t… Pluck No fix yet Fix from $1,6002017-03-17 MEDIUM 5.3 CVE-2014-8706 Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to… Pluck No fix yet Fix from $1,6002017-03-17 MEDIUM 6.8 CVE-2012-1227 Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins fo… Pluck No fix yet Fix from $1,6002012-02-21 MEDIUM 6.8 CVE-2008-6842 Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary … Pluck No fix yet Fix from $1,6002009-07-02 MEDIUM 6.8 CVE-2009-1765EPSS 15% Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to include and execute arbitrar… Pluck No fix yet Fix from $1,6002009-05-22 MEDIUM 6.8 CVE-2008-6253 Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include… Pluck No fix yet Fix from $1,6002009-02-24