Pluck-Cms Pluck vulnerabilities

CVE-2020-20919 [HIGH] CWE-434 CVE-2020-20919: File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary c File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file.

CVE-2023-27083 [HIGH] CWE-434 CVE-2023-27083: An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality.

CVE-2020-20918 [HIGH] CWE-94 CVE-2020-20918: An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php cod An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page.

CVE-2020-18198 [HIGH] CWE-352 CVE-2020-18198: Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary c Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."

CVE-2020-18195 [HIGH] CWE-352 CVE-2020-18195: Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary c Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."

CVE-2022-27432 [HIGH] CWE-352 CVE-2022-27432: A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.

CVE-2018-16634 [HIGH] CWE-352 CVE-2018-16634: Pluck v4.7.7 allows CSRF via admin.php?action=settings. Pluck v4.7.7 allows CSRF via admin.php?action=settings.

CVE-2023-5013 [MEDIUM] CWE-79 CVE-2023-5013: A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input alert('xss') leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is

CVE-2019-9049 [MEDIUM] CWE-352 CVE-2019-9049: An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules v An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=module_delete&var1= URI.

CVE-2019-9051 [MEDIUM] CWE-352 CVE-2019-9051: An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI.

CVE-2019-9052 [MEDIUM] CWE-352 CVE-2019-9052: An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI.

CVE-2022-26589 [MEDIUM] CWE-352 CVE-2022-26589: A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages.

CVE-2018-7197 [MEDIUM] CWE-79 CVE-2018-7197: An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability al An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL.

CVE-2019-9048 [MEDIUM] CWE-352 CVE-2019-9048: An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme ( An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme (aka topic) via a /admin.php?action=theme_delete&var1= URI.

CVE-2012-1227 [MEDIUM] CWE-352 CVE-2012-1227: Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote at Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins for requests that (1) modify the admin email address or (2) modify the blog title via a settings action; (3) add a page via an editpage action, or (4) add a categorie via the blog module.

CVE-2018-16729 [MEDIUM] CWE-79 CVE-2018-16729: Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files.

CVE-2014-8707 [MEDIUM] CWE-79 CVE-2014-8707: Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated u Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option.

CVE-2018-16633 [MEDIUM] CWE-79 CVE-2018-16633: Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title. Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.

CVE-2021-31747 [MEDIUM] CWE-295 CVE-2021-31747: Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could le Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-middle attacks.

CVE-2018-11330 [MEDIUM] CWE-79 CVE-2018-11330: An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the charact An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.