Skip to content
Noroxi

pluck-cms records

46 published records for vendor pluck-cms.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
12
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

46 records
  • CVE-2023-50564
    44Plan

    An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary

    HighCVSS 8.8Proof of conceptEPSS 29%

    pluck-cms · pluckDec 14, 2023

  • CVE-2018-11736
    42Plan

    An issue was discovered in Pluck before 4.7.7-dev2.

    CriticalCVSS 9.8Proof of conceptEPSS 9%

    pluck-cms · pluckJun 5, 2018

  • CVE-2020-20951
    40Plan

    In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.

    CriticalCVSS 9.8No exploitEPSS 4%

    pluck-cms · pluckMay 18, 2021

  • CVE-2019-11344
    40Plan

    data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler

    CriticalCVSS 9.8No exploitEPSS 4%

    pluck-cms · pluckApr 19, 2019

  • CVE-2014-8708
    40Plan

    Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.

    CriticalCVSS 9.8No exploitEPSS 3%

    pluck-cms · pluckMar 17, 2017

  • CVE-2021-31746
    40Plan

    Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal

    CriticalCVSS 9.8No exploitEPSS 2%

    pluck-cms · pluckDec 10, 2021

  • CVE-2018-11331
    40Plan

    An issue was discovered in Pluck before 4.7.6.

    CriticalCVSS 9.8No exploitEPSS 2%

    pluck-cms · pluckMay 21, 2018

  • CVE-2019-1010062
    40Plan

    PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type.

    CriticalCVSS 9.8No exploitEPSS 2%

    pluck-cms · pluckcmsJul 16, 2019

  • CVE-2022-26965
    39Monitor

    In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.

    HighCVSS 7.2Proof of conceptEPSS 36%

    pluck-cms · pluckMar 18, 2022

  • CVE-2020-20718
    39Monitor

    File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to t

    CriticalCVSS 9.8No exploitEPSS 1%

    pluck-cms · pluckcmsJun 20, 2023

  • CVE-2024-43042
    39Monitor

    Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.

    CriticalCVSS 9.8No exploitEPSS 1%

    pluck-cms · pluckAug 16, 2024

  • CVE-2020-29607
    38Monitor

    A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through

    HighCVSS 7.2Proof of conceptEPSS 33%

    pluck-cms · pluckDec 16, 2020

  • CVE-2020-21564
    36Monitor

    An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11.

    HighCVSS 8.8No exploitEPSS 3%

    pluck-cms · pluckSep 30, 2020

  • CVE-2020-18198
    35Monitor

    Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the c

    HighCVSS 8.8No exploitEPSS 1%

    pluck-cms · pluckMay 17, 2021

  • CVE-2020-18195
    35Monitor

    Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via th

    HighCVSS 8.8No exploitEPSS 1%

    pluck-cms · pluckMay 17, 2021

  • CVE-2022-27432
    35Monitor

    A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this featur

    HighCVSS 8.8No exploitEPSS 1%

    pluck-cms · pluckMar 29, 2022

  • CVE-2018-16634
    35Monitor

    Pluck v4.7.7 allows CSRF via admin.php?action=settings.

    HighCVSS 8.8No exploitEPSS 1%

    pluck-cms · pluckDec 4, 2018

  • CVE-2021-27984
    33Monitor

    In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.

    HighCVSS 8.1No exploitEPSS 3%

    pluck-cms · pluckDec 10, 2021

  • CVE-2009-1765
    32Monitor

    Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to include and execute

    MediumCVSS 6.8Proof of conceptEPSS 15%

    pluck-cms · pluckMay 22, 2009

  • CVE-2020-20969
    30Monitor

    File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file.

    HighCVSS 7.2Proof of conceptEPSS 6%

    pluck-cms · pluckJun 20, 2023

  • CVE-2021-31745
    30Monitor

    Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform.

    HighCVSS 7.5No exploitEPSS 1%

    pluck-cms · pluckDec 10, 2021

  • CVE-2019-9050
    29Monitor

    An issue was discovered in Pluck 4.7.9-dev1.

    HighCVSS 7.2No exploitEPSS 2%

    pluck-cms · pluckFeb 23, 2019

  • CVE-2008-6253
    28Monitor

    Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers t

    MediumCVSS 6.8Proof of conceptEPSS 5%

    pluck-cms · pluckFeb 24, 2009

  • CVE-2008-6842
    28Monitor

    Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute a

    MediumCVSS 6.8Proof of conceptEPSS 2%

    pluck-cms · pluckJul 2, 2009

  • CVE-2023-25828
    28Monitor

    Authenticate Remote Code Execution in Pluck CMS

    HighCVSS 7.2No exploitEPSS 2%

    pluck-cms · pluckMar 27, 2023