Pluck-Cms / Pluck
43 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2025-46099 | In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routi… | HIGH | 7.2 | Jul 23, 2025 |
| CVE-2024-43042 | Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack. | CRITICAL | 9.8 | Aug 16, 2024 |
| CVE-2023-50564 | An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading… | HIGH | 8.8 | Dec 14, 2023 |
| CVE-2023-5013 | Pluck CMS Installation install.php cross site scripting | MEDIUM | 5.4 | Sep 16, 2023 |
| CVE-2023-27082 | Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code via upload of craf… | MEDIUM | 4.8 | Jun 26, 2023 |
| CVE-2023-27083 | An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality. | HIGH | 7.2 | Jun 22, 2023 |
| CVE-2020-20969 | File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file. | HIGH | 7.2 | Jun 20, 2023 |
| CVE-2020-20919 | File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file. | HIGH | 7.2 | Jun 20, 2023 |
| CVE-2020-20918 | An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page. | HIGH | 7.2 | Jun 20, 2023 |
| CVE-2023-25828 | Authenticate Remote Code Execution in Pluck CMS | HIGH | 7.2 | Mar 27, 2023 |
| CVE-2022-26589 | A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. | MEDIUM | 6.5 | Apr 12, 2022 |
| CVE-2022-27432 | A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to accoun… | HIGH | 8.8 | Mar 29, 2022 |
| CVE-2022-26965 | In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution. | HIGH | 7.2 | Mar 18, 2022 |
| CVE-2021-27984 | In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files. | HIGH | 8.1 | Dec 10, 2021 |
| CVE-2021-31747 | Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-middle attacks. | MEDIUM | 4.8 | Dec 10, 2021 |
| CVE-2021-31746 | Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arb… | CRITICAL | 9.8 | Dec 10, 2021 |
| CVE-2021-31745 | Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not… | HIGH | 7.5 | Dec 10, 2021 |
| CVE-2020-20951 | In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files. | CRITICAL | 9.8 | May 18, 2021 |
| CVE-2020-24740 | An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage | MEDIUM | 4.3 | May 18, 2021 |
| CVE-2020-18198 | Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.p… | HIGH | 8.8 | May 17, 2021 |
| CVE-2020-18195 | Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admi… | HIGH | 8.8 | May 17, 2021 |
| CVE-2020-29607 | A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files"… | HIGH | 7.2 | Dec 16, 2020 |
| CVE-2020-21564 | An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?actio… | HIGH | 8.8 | Sep 30, 2020 |
| CVE-2019-11344 | data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .… | CRITICAL | 9.8 | Apr 19, 2019 |
| CVE-2019-9052 | An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI. | MEDIUM | 6.5 | Feb 23, 2019 |
Showing 1 to 25 of 43 CVEs