Pluck vulnerabilities
5 known vulnerabilities in Pluck from Pluck-cms. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
Pluck: Unrestricted Upload of File with Dangerous Type
In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.
- 8.8 High severity
Pluck: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.
- 7.2 High severity
Pluck: Unrestricted Upload of File with Dangerous Type
An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality.
- 7.2 High severity
pluck-cms: Unrestricted Upload of File with Dangerous Type
Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes
- 8.8 High severity
Pluck: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.