Every CVE Search/ Get API key

CVE-2023-5013

Pluck CMS Installation install.php cross site scripting

2.6 Low

CVE-2023-5013 is a low vulnerability (CVSS 2.6) in Pluck Cms, published September 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.57%, the 47th percentile. No source names a fixed version.

A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.57%Up 0.5 points since Sep 17, 2023
90%50%10%1%

What each source reports

CVE List Score used 2.6

Pluck CMS Installation install.php cross site scripting

A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.

Record
CVE-2023-5013
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 3.0
2.6 LowCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 2.0
2.1 AV:N/AC:H/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2023-57359 2.6

A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.

Record
EUVD-2023-57359
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-p69j-9595-rm77 2.6

A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This...

A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.

Record
GHSA-p69j-9595-rm77
CVSS 3.0
2.6 LowCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 2.6

A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.

Record
CVE-2023-5013
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
2.1 LowAV:N/AC:H/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 2.6

Pluck CMS Installation install.php cross site scripting

A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.

Record
CVE-2023-5013
CVSS 3.1
2.6 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected products

History

History
WhenChangedSources
2026-11-03aliases, products, publishedEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

MoveEnter Open