{"id":"CVE-2018-11331","aliases":["EUVD-2018-3368","GHSA-8v5g-x5hv-26fq"],"status":"published","title":"An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the...","description":"An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02186,"percentile":0.82512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2018-05-21T21:00:00Z","modified":"2026-10-20T10:49:59Z","products":[{"vendor":"pluck-cms","product":"pluck"}],"references":[{"url":"https://github.com/pluck-cms/pluck/issues/58","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11331"},{"url":"https://github.com/advisories/GHSA-8v5g-x5hv-26fq"}],"sources":{"cve":[{"id":"CVE-2018-11331","description":"An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.","status":"published","published":"2018-05-21T21:00:00Z","modified":"2024-09-16T20:22:25.465Z","updated_at":"2026-11-02T14:35:09.570381Z"}],"euvd":[{"id":"EUVD-2018-3368","description":"An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.","status":"published","published":"2018-05-21T21:00:00Z","modified":"2024-09-16T20:22:25Z","updated_at":"2026-11-03T00:55:14.527578Z"}],"ghsa":[{"id":"GHSA-8v5g-x5hv-26fq","title":"An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the...","description":"An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.","status":"published","published":"2022-05-14T03:17:16Z","modified":"2023-02-02T05:07:16Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:52:28.437617Z"}],"nvd":[{"id":"CVE-2018-11331","description":"An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.","status":"published","published":"2018-05-21T21:29:00.33Z","modified":"2026-06-17T01:35:44.29Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"CVE-2018-11331","description":"An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.","status":"published","published":"2018-05-21T21:29:00.33Z","modified":"2026-10-20T10:49:59.043778024Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:07.934182Z"}]}}