Vulnerabilities > Pluck CMS > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-12-16 | CVE-2020-29607 | Unrestricted Upload of File with Dangerous Type vulnerability in Pluck-Cms Pluck A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files" functionality, which may result in remote code execution. | 6.5 |
| 2020-09-30 | CVE-2020-21564 | Unrestricted Upload of File with Dangerous Type vulnerability in Pluck-Cms Pluck 4.7.10/4.7.11 An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. | 6.5 |
| 2019-02-23 | CVE-2019-9052 | Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.9 An issue was discovered in Pluck 4.7.9-dev1. | 5.8 |
| 2019-02-23 | CVE-2019-9051 | Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.9 An issue was discovered in Pluck 4.7.9-dev1. | 5.8 |
| 2019-02-23 | CVE-2019-9050 | Unrestricted Upload of File with Dangerous Type vulnerability in Pluck-Cms Pluck 4.7.9 An issue was discovered in Pluck 4.7.9-dev1. | 6.5 |
| 2019-02-23 | CVE-2019-9049 | Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.9 An issue was discovered in Pluck 4.7.9-dev1. | 5.8 |
| 2019-02-23 | CVE-2019-9048 | Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.9 An issue was discovered in Pluck 4.7.9-dev1. | 5.8 |
| 2018-12-04 | CVE-2018-16634 | Cross-Site Request Forgery (CSRF) vulnerability in Pluck-Cms Pluck 4.7.7 Pluck v4.7.7 allows CSRF via admin.php?action=settings. | 6.8 |
| 2018-02-18 | CVE-2018-7197 | Cross-site Scripting vulnerability in Pluck-Cms Pluck An issue was discovered in Pluck through 4.7.4. | 4.3 |
| 2017-03-17 | CVE-2014-8707 | Cross-site Scripting vulnerability in Pluck-Cms Pluck 4.7.2 Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option. | 4.0 |