Pluck
by Pluck
Source repositories
CVEs (47)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2014-8708 | Cri | 0.64 | 9.8 | 0.03 | Mar 17, 2017 | Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature. | ||
| CVE-2018-11736 | Cri | 0.60 | 9.8 | 0.09 | Jun 5, 2018 | An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file. | ||
| CVE-2018-7197 | Med | 0.40 | 6.1 | 0.01 | Feb 18, 2018 | An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL. | ||
| CVE-2026-31205 | Med | 0.37 | 5.7 | 0.00 | May 4, 2026 | Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageContent function | ||
| CVE-2024-9405 | Med | 0.35 | 5.3 | 0.00 | Oct 1, 2024 | An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information from the server via the absolute path of a file located in the same directory or… | ||
| CVE-2018-16729 | Med | 0.35 | 5.4 | 0.01 | Sep 12, 2018 | Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files. | ||
| CVE-2014-8707 | Med | 0.35 | 5.4 | 0.01 | Mar 17, 2017 | Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option. | ||
| CVE-2014-8706 | Med | 0.35 | 5.3 | 0.01 | Mar 17, 2017 | Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSID"; (3) changing the image parameter to an array; or (4) changing the image parameter to a string, which reveals the… | ||
| CVE-2020-29607 | 0.10 | — | 0.33 | Dec 16, 2020 | A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution. | |||
| CVE-2022-26965 | 0.05 | — | 0.38 | Mar 18, 2022 | In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution. | |||
| CVE-2009-1765 | 0.04 | — | 0.15 | May 22, 2009 | Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langpref parameter to (1) data/modules/contactform/module_info.php, (2)… | |||
| CVE-2008-3851 | 0.04 | — | 0.08 | Aug 27, 2008 | Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the (1) blogpost, (2) cat, and (3) file parameters to data/inc/themes/predefined_variables.php, as… | |||
| CVE-2023-50564 | 0.03 | — | 0.29 | Dec 14, 2023 | An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file. | |||
| CVE-2008-6842 | 0.03 | — | 0.02 | Jul 2, 2009 | Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the post parameter. | |||
| CVE-2008-6253 | 0.03 | — | 0.05 | Feb 24, 2009 | Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the g_pcltar_lib_dir parameter. | |||
| CVE-2008-3574 | 0.03 | — | 0.02 | Aug 10, 2008 | Multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lang_footer parameter to (a) data/inc/footer.php; the (2) pluck_version, (3) lang_install22, (4)… | |||
| CVE-2008-3194 | 0.03 | — | 0.03 | Jul 16, 2008 | Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php in pluck 4.5.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) langpref, (2) file, (3) blogpost, or (4) cat parameter. | |||
| CVE-2020-20951 | 0.01 | — | 0.04 | May 18, 2021 | In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files. | |||
| CVE-2025-46099 | 0.00 | — | 0.01 | Jul 23, 2025 | In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter. | |||
| CVE-2024-43042 | 0.00 | — | 0.01 | Aug 16, 2024 | Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack. |
- risk 0.64cvss 9.8epss 0.03
Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
- risk 0.60cvss 9.8epss 0.09
An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file.
- risk 0.40cvss 6.1epss 0.01
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL.
- risk 0.37cvss 5.7epss 0.00
Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageContent function
- risk 0.35cvss 5.3epss 0.00
An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information from the server via the absolute path of a file located in the same directory or…
- risk 0.35cvss 5.4epss 0.01
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files.
- risk 0.35cvss 5.4epss 0.01
Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option.
- risk 0.35cvss 5.3epss 0.01
Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSID"; (3) changing the image parameter to an array; or (4) changing the image parameter to a string, which reveals the…
- CVE-2020-29607Dec 16, 2020risk 0.10cvss —epss 0.33
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution.
- CVE-2022-26965Mar 18, 2022risk 0.05cvss —epss 0.38
In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.
- CVE-2009-1765May 22, 2009risk 0.04cvss —epss 0.15
Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langpref parameter to (1) data/modules/contactform/module_info.php, (2)…
- CVE-2008-3851Aug 27, 2008risk 0.04cvss —epss 0.08
Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the (1) blogpost, (2) cat, and (3) file parameters to data/inc/themes/predefined_variables.php, as…
- CVE-2023-50564Dec 14, 2023risk 0.03cvss —epss 0.29
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.
- CVE-2008-6842Jul 2, 2009risk 0.03cvss —epss 0.02
Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the post parameter.
- CVE-2008-6253Feb 24, 2009risk 0.03cvss —epss 0.05
Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the g_pcltar_lib_dir parameter.
- CVE-2008-3574Aug 10, 2008risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lang_footer parameter to (a) data/inc/footer.php; the (2) pluck_version, (3) lang_install22, (4)…
- CVE-2008-3194Jul 16, 2008risk 0.03cvss —epss 0.03
Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php in pluck 4.5.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) langpref, (2) file, (3) blogpost, or (4) cat parameter.
- CVE-2020-20951May 18, 2021risk 0.01cvss —epss 0.04
In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.
- CVE-2025-46099Jul 23, 2025risk 0.00cvss —epss 0.01
In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.
- CVE-2024-43042Aug 16, 2024risk 0.00cvss —epss 0.01
Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.
Page 1 of 3