{"id":"CVE-2023-50564","aliases":["EUVD-2023-55346","GHSA-phw8-53h6-pq4g"],"status":"published","title":"An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4...","description":"An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.29282,"percentile":0.98189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-434"],"published":"2023-12-14T00:00:00Z","modified":"2026-10-28T02:30:37Z","exploits":[{"source":"pocgithub","id":"0xDTC/Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564","title":"0xDTC/Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564","date":"2024-10-27","url":"https://github.com/0xDTC/Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-50564"},{"source":"pocgithub","id":"Mrterrestrial/CVE-2023-50564","title":"Mrterrestrial/CVE-2023-50564","date":"2024-10-15","url":"https://github.com/Mrterrestrial/CVE-2023-50564"},{"source":"pocgithub","id":"Rai2en/CVE-2023-50564_Pluck-v4.7.18_PoC","title":"Rai2en/CVE-2023-50564_Pluck-v4.7.18_PoC","date":"2024-07-21","url":"https://github.com/Rai2en/CVE-2023-50564_Pluck-v4.7.18_PoC"},{"source":"pocgithub","id":"glynzr/CVE-2023-50564","title":"glynzr/CVE-2023-50564","date":"2025-05-24","url":"https://github.com/glynzr/CVE-2023-50564"},{"source":"pocgithub","id":"ipuig/CVE-2023-50564","title":"ipuig/CVE-2023-50564","date":"2024-08-02","url":"https://github.com/ipuig/CVE-2023-50564"},{"source":"pocgithub","id":"rwexecute/CVE-2023-50564","title":"rwexecute/CVE-2023-50564","date":"2024-08-17","url":"https://github.com/rwexecute/CVE-2023-50564"},{"source":"pocgithub","id":"thefizzyfish/CVE-2023-50564-pluck","title":"thefizzyfish/CVE-2023-50564-pluck","date":"2024-08-24","url":"https://github.com/thefizzyfish/CVE-2023-50564-pluck"},{"source":"pocgithub","id":"xpltive/CVE-2023-50564","title":"xpltive/CVE-2023-50564","date":"2024-12-22","url":"https://github.com/xpltive/CVE-2023-50564"}],"products":[{"vendor":"pluck-cms","product":"pluck"}],"references":[{"url":"https://github.com/SecBridge/Cms_Vuls_test/blob/main/Pluckcms/Pluck_v4.7.18_Any_File_Upload_Getshell.md","tags":["x_transferred","Exploit","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50564","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-phw8-53h6-pq4g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50564.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-50564","description":"An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2024-10-08T14:22:58.932Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-55346","description":"An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2024-10-08T14:22:58Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:27:45.808193Z"}],"ghsa":[{"id":"GHSA-phw8-53h6-pq4g","title":"An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4...","description":"An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.","status":"published","published":"2023-12-14T15:30:23Z","modified":"2023-12-18T21:30:24Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:55:14.600975Z"}],"nvd":[{"id":"CVE-2023-50564","description":"An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.","status":"published","published":"2023-12-14T15:15:10.36Z","modified":"2026-06-17T06:39:44.593Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:08:54.696438Z"}],"osv":[{"id":"CVE-2023-50564","description":"An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.","status":"published","published":"2023-12-14T00:00:00Z","modified":"2026-10-28T02:30:37.055033708Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:35.245372Z"}]}}