Vulnerabilities > Pluck CMS
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-12-04 | CVE-2018-16634 | Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.7 Pluck v4.7.7 allows CSRF via admin.php?action=settings. | 8.8 |
| 2018-12-04 | CVE-2018-16633 | Cross-site Scripting vulnerability in Pluck-Cms Pluck 4.7.7 Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title. | 5.4 |
| 2018-09-12 | CVE-2018-16729 | Cross-site Scripting vulnerability in Pluck-Cms Pluck 4.7.7 Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files. | 5.4 |
| 2018-06-05 | CVE-2018-11736 | Unrestricted Upload of File with Dangerous Type vulnerability in Pluck-Cms Pluck An issue was discovered in Pluck before 4.7.7-dev2. | 9.8 |
| 2018-05-21 | CVE-2018-11331 | Unrestricted Upload of File with Dangerous Type vulnerability in Pluck-Cms Pluck An issue was discovered in Pluck before 4.7.6. | 9.8 |
| 2018-05-21 | CVE-2018-11330 | Cross-site Scripting vulnerability in Pluck-Cms Pluck An issue was discovered in Pluck before 4.7.6. | 4.8 |
| 2018-02-18 | CVE-2018-7197 | Cross-site Scripting vulnerability in Pluck-Cms Pluck An issue was discovered in Pluck through 4.7.4. | 6.1 |
| 2017-03-17 | CVE-2014-8708 | Permissions, Privileges, and Access Controls vulnerability in Pluck-Cms Pluck 4.7.2 Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature. | 9.8 |
| 2017-03-17 | CVE-2014-8707 | Cross-site Scripting vulnerability in Pluck-Cms Pluck 4.7.2 Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option. | 5.4 |
| 2017-03-17 | CVE-2014-8706 | Information Exposure vulnerability in Pluck-Cms Pluck 4.7.2 Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSID"; (3) changing the image parameter to an array; or (4) changing the image parameter to a string, which reveals the installation path in an error message. | 5.3 |