CVE-2026-70376 | Critical | 9.6 | 2026-08-05 | Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action)… |
CVE-2026-54416 | High | 7.2 | 2026-08-05 | Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','ph… |
CVE-2025-46099 | High | 7.2 | 2025-07-23 | In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routi… |
CVE-2024-43042 | Critical | 9.8 | 2024-08-16 | Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack. |
CVE-2023-50564 | High | 8.8 | 2023-12-14 | An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading… |
CVE-2023-5013 | Low | 2.6 | 2023-09-16 | A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the compon… |
CVE-2023-27082 | Medium | 4.8 | 2023-06-26 | Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code via upload of craf… |
CVE-2023-27083 | High | 7.2 | 2023-06-22 | An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality. |
CVE-2020-20969 | High | 7.2 | 2023-06-20 | File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file. |
CVE-2020-20919 | High | 7.2 | 2023-06-20 | File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file. |
CVE-2020-20918 | High | 7.2 | 2023-06-20 | An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page. |
CVE-2020-20718 | Critical | 9.8 | 2023-06-20 | File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to the the save_file()… |
CVE-2023-25828 | High | 7.2 | 2023-03-27 |
Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of im… |
CVE-2022-26589 | Medium | 6.5 | 2022-04-13 | A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages. |
CVE-2022-27432 | High | 8.8 | 2022-03-30 | A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to accoun… |
CVE-2022-26965 | High | 7.2 | 2022-03-18 | In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution. |
CVE-2021-31747 | Medium | 4.8 | 2021-12-10 | Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-middle attacks. |
CVE-2021-27984 | High | 8.1 | 2021-12-10 | In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files. |
CVE-2021-31746 | Critical | 9.8 | 2021-12-10 | Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arb… |
CVE-2021-31745 | High | 7.5 | 2021-12-10 | Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not… |
CVE-2020-24740 | Medium | 4.3 | 2021-05-18 | An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage |
CVE-2020-20951 | Critical | 9.8 | 2021-05-18 | In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files. |
CVE-2020-18198 | High | 8.8 | 2021-05-17 | Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.p… |
CVE-2020-18195 | High | 8.8 | 2021-05-17 | Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admi… |
CVE-2020-29607 | High | 7.2 | 2020-12-16 | A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the "manage files"… |
CVE-2020-21564 | High | 8.8 | 2020-09-30 | An issue was discovered in Pluck CMS 4.7.10-dev2 and 4.7.11. There is a file upload vulnerability that can cause a remote command execution via admin.php?actio… |
CVE-2019-1010062 | Critical | 9.8 | 2019-07-16 | PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/ima… |
CVE-2019-11344 | Critical | 9.8 | 2019-04-19 | data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a… |
CVE-2019-9052 | Medium | 6.5 | 2019-02-23 | An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete pictures via a /admin.php?action=deleteimage&var1= URI. |
CVE-2019-9051 | Medium | 6.5 | 2019-02-23 | An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete articles via a /admin.php?action=deletepage&var1= URI. |
CVE-2019-9050 | High | 7.2 | 2019-02-23 | An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code by using action=installmodule to upload a ZIP archive, which is… |
CVE-2019-9049 | Medium | 6.5 | 2019-02-23 | An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete modules via a /admin.php?action=module_delete&var1= URI. |
CVE-2019-9048 | Medium | 6.5 | 2019-02-23 | An issue was discovered in Pluck 4.7.9-dev1. There is a CSRF vulnerability that can delete a theme (aka topic) via a /admin.php?action=theme_delete&var1= URI. |
CVE-2018-16634 | High | 8.8 | 2018-12-04 | Pluck v4.7.7 allows CSRF via admin.php?action=settings. |
CVE-2018-16633 | Medium | 5.4 | 2018-12-04 | Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title. |
CVE-2018-16729 | Medium | 5.4 | 2018-09-12 | Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files. |
CVE-2018-11736 | Critical | 9.8 | 2018-06-05 | An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jp… |
CVE-2018-11331 | Critical | 9.8 | 2018-05-21 | An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applic… |
CVE-2018-11330 | Medium | 4.8 | 2018-05-21 | An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted. |
CVE-2018-7197 | Medium | 6.1 | 2018-02-18 | An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web s… |
CVE-2014-8708 | Critical | 9.8 | 2017-03-17 | Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature. |
CVE-2014-8707 | Medium | 5.4 | 2017-03-17 | Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit H… |
CVE-2014-8706 | Medium | 5.3 | 2017-03-17 | Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSI… |
CVE-2012-1227 | | | 2012-02-21 | Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins for requests… |
CVE-2008-6842 | | | 2009-07-02 | Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local file… |
CVE-2009-1765 | | | 2009-05-22 | Multiple directory traversal vulnerabilities in pluck 4.6.2, when register_globals is enabled, allow remote attackers to include and execute arbitrary local fi… |
CVE-2008-6253 | | | 2009-02-24 | Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include and execu… |