Vulnerabilities > Pluck CMS > Pluck > 4.7.7

DATE CVE VULNERABILITY TITLE RISK
2023-03-27 CVE-2023-25828 Unrestricted Upload of File with Dangerous Type vulnerability in Pluck-Cms Pluck
Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module.
network
low complexity
pluck-cms CWE-434
7.2
2020-12-16 CVE-2020-29607 Unrestricted Upload of File with Dangerous Type vulnerability in Pluck-Cms Pluck
A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution.
network
low complexity
pluck-cms CWE-434
7.2
2018-12-04 CVE-2018-16634 Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.7
Pluck v4.7.7 allows CSRF via admin.php?action=settings.
network
low complexity
pluck-cms CWE-352
8.8
2018-12-04 CVE-2018-16633 Cross-site Scripting vulnerability in Pluck-Cms Pluck 4.7.7
Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.
network
low complexity
pluck-cms CWE-79
5.4
2018-09-12 CVE-2018-16729 Cross-site Scripting vulnerability in Pluck-Cms Pluck 4.7.7
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files.
network
low complexity
pluck-cms CWE-79
5.4
2018-06-05 CVE-2018-11736 Unrestricted Upload of File with Dangerous Type vulnerability in Pluck-Cms Pluck
An issue was discovered in Pluck before 4.7.7-dev2.
network
low complexity
pluck-cms CWE-434
critical
9.8