Pluck-cms Pluck vulnerabilities

• pluck cms cms, pluck-cms pluck cms +1 more Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE CVE-2026-70376 Public exploit 9.6 CriticalAugust 5, 2026
• pluck cms cms, pluck-cms pluck cms +1 more Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist CVE-2026-54416 7.2 HighAugust 5, 2026
• pluck-cms pluck In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under... CVE-2025-46099 Public exploit 7.2 HighJuly 23, 2025
• pluck cms cms, pluck-cms pluckcms +1 more An incorrect limitation of a path to a restricted directory (path traversal) has been detected in... CVE-2024-9405 5.3 MediumOctober 1, 2024
• pluck-cms pluck Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute... CVE-2024-43042 9.8 CriticalAugust 16, 2024
• pluck-cms pluck An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4... CVE-2023-50564 Public exploit EPSS 29.3% 8.8 HighDecember 14, 2023
• pluck cms, pluck-cms pluck +1 more Pluck CMS Installation install.php cross site scripting CVE-2023-5013 2.6 LowSeptember 16, 2023
• pluck-cms pluck Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4... CVE-2023-27082 4.8 MediumJune 26, 2023
• pluck-cms pluck An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers... CVE-2023-27083 7.2 HighJune 22, 2023
• pluck-cms pluck File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code... CVE-2020-20969 Public exploit 7.2 HighJune 20, 2023
• pluck-cms pluck File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute... CVE-2020-20919 7.2 HighJune 20, 2023
• pluck-cms pluck An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php... CVE-2020-20918 7.2 HighJune 20, 2023
• pluck-cms pluckcms File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute... CVE-2020-20718 9.8 CriticalJune 20, 2023
• pluck-cms pluck, pluck pluck-cms +1 more Authenticate Remote Code Execution in Pluck CMS CVE-2023-25828 7.2 HighMarch 27, 2023
• pluck-cms pluck A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. CVE-2022-26589 6.5 MediumApril 12, 2022
• pluck-cms pluck A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password... CVE-2022-27432 8.8 HighMarch 29, 2022
• pluck-cms pluck In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action... CVE-2022-26965 Public exploit EPSS 36.3% 7.2 HighMarch 18, 2022
• pluck-cms pluck In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading... CVE-2021-27984 8.1 HighDecember 10, 2021
• pluck-cms pluck Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could... CVE-2021-31747 4.8 MediumDecember 10, 2021
• pluck-cms pluck Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted... CVE-2021-31746 9.8 CriticalDecember 10, 2021
• pluck-cms pluck Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to... CVE-2021-31745 7.5 HighDecember 10, 2021
• pluck-cms pluck In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when... CVE-2020-20951 9.8 CriticalMay 18, 2021
• pluck-cms pluck An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via... CVE-2020-24740 4.3 MediumMay 18, 2021
• pluck-cms pluck Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute... CVE-2020-18198 8.8 HighMay 17, 2021
• pluck-cms pluck Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute... CVE-2020-18195 8.8 HighMay 17, 2021
• pluck-cms pluck A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin... CVE-2020-29607 Public exploit EPSS 33.2% 7.2 HighDecember 16, 2020
• pluck-cms pluck An issue was discovered in Pluck CMS v4.7.11. There is a file upload vulnerability that can cause... CVE-2020-21564 8.8 HighSeptember 30, 2020
• pluck-cms pluckcms PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous... CVE-2019-1010062 9.8 CriticalJuly 16, 2019
• pluck-cms pluck data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading... CVE-2019-11344 9.8 CriticalApril 19, 2019
• pluck-cms pluck An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete... CVE-2019-9052 6.5 MediumFebruary 23, 2019
• pluck-cms pluck An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete... CVE-2019-9051 6.5 MediumFebruary 23, 2019
• pluck-cms pluck An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code... CVE-2019-9050 7.2 HighFebruary 23, 2019
• pluck-cms pluck An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete... CVE-2019-9049 6.5 MediumFebruary 23, 2019
• pluck-cms pluck An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a... CVE-2019-9048 6.5 MediumFebruary 23, 2019
• pluck-cms pluck Pluck v4.7.7 allows CSRF via admin.php?action=settings. CVE-2018-16634 8.8 HighDecember 4, 2018
• pluck-cms pluck Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title. CVE-2018-16633 5.4 MediumDecember 4, 2018
• pluck-cms pluck Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is... CVE-2018-16729 5.4 MediumSeptember 12, 2018
• pluck-cms pluck An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers... CVE-2018-11736 Public exploit 9.8 CriticalJune 5, 2018
• pluck-cms pluck An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the... CVE-2018-11331 9.8 CriticalMay 21, 2018
• pluck-cms pluck An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the... CVE-2018-11330 4.8 MediumMay 21, 2018
• pluck-cms pluck An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability... CVE-2018-7197 Public exploit 6.1 MediumFebruary 18, 2018
• pluck-cms pluck Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature. CVE-2014-8708 9.8 CriticalMarch 17, 2017
• pluck-cms pluck Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote... CVE-2014-8707 5.4 MediumMarch 17, 2017
• pluck-cms pluck Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing ... CVE-2014-8706 5.3 MediumMarch 17, 2017
• pluck-cms pluck Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote... CVE-2012-1227 6.8 MediumFebruary 21, 2012
• pluck-cms pluck Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1... CVE-2008-6842 Public exploit 6.8 MediumJuly 2, 2009
• pluck-cms pluck Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled,... CVE-2009-1765 Public exploit EPSS 19.7% 6.8 MediumMay 22, 2009
• pluck-cms pluck Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when... CVE-2008-6253 Public exploit 6.8 MediumFebruary 24, 2009