Pluck-Cms Pluck Cms
3 CVEs affecting Pluck-Cms Pluck Cms. Latest disclosed: 2026-08-05. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-70376 | Critical | 9.6 | 2026-08-05 | Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action)… |
CVE-2026-54416 | High | 7.2 | 2026-08-05 | Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','ph… |
CVE-2024-9405 | Medium | 5.3 | 2024-10-01 | An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attac… |