Vulnerabilities > Pluck CMS

DATE CVE VULNERABILITY TITLE RISK
2021-05-18 CVE-2020-20951 Command Injection vulnerability in Pluck-Cms Pluck 4.7.10
In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.
network
low complexity
pluck-cms CWE-77
7.5
2021-05-18 CVE-2020-24740 Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.10
An issue was discovered in Pluck 4.7.10-dev2.
network
pluck-cms CWE-352
4.3
2021-05-17 CVE-2020-18195 Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.9
Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."
network
pluck-cms CWE-352
6.8
2021-05-17 CVE-2020-18198 Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.9
Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."
network
pluck-cms CWE-352
6.8
2020-12-16 CVE-2020-29607 Unrestricted Upload of File With Dangerous Type vulnerability in Pluck-Cms Pluck
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution.
network
low complexity
pluck-cms CWE-434
6.5
2020-09-30 CVE-2020-21564 Unrestricted Upload of File With Dangerous Type vulnerability in Pluck-Cms Pluck 4.7.11
An issue was discovered in Pluck CMS v4.7.11.
network
low complexity
pluck-cms CWE-434
6.5
2019-07-16 CVE-2019-1010062 Unrestricted Upload of File With Dangerous Type vulnerability in Pluck-Cms Pluckcms
PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type.
network
low complexity
pluck-cms CWE-434
7.5
2019-04-19 CVE-2019-11344 Unrestricted Upload of File With Dangerous Type vulnerability in Pluck-Cms Pluck 4.7.8
data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked.
network
low complexity
pluck-cms CWE-434
7.5
2019-02-23 CVE-2019-9052 Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.9
An issue was discovered in Pluck 4.7.9-dev1.
network
pluck-cms CWE-352
5.8
2019-02-23 CVE-2019-9051 Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.9
An issue was discovered in Pluck 4.7.9-dev1.
network
pluck-cms CWE-352
5.8