Approved changes feed: RSS · Atom
cpe:2.3:a:pluck:pluck:4.5.2:*:*:*:*:*:*:*
part: a version: 4.5.2 update: *
| Vendor | Pluck (23427c6f-cf9f-5846-8ba4-d6c64a040a15) |
|---|---|
| Product | Pluck (3cbbcca0-907f-5b19-8210-be9b11cbb70b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pluck-cms/pluck |
purl2cpe | 2026-06-01 10:15:00.663271 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2008-3851 |
vulnerable | 2026-06-08 04:50:36.880388 |
Details available
Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the (1) blogpost, (2) cat, and (3) file parameters to data/inc/themes/predefined_variables.php, as reachable through index.php; and the (4) blogpost and (5) cat parameters to data/inc/blog_include_react.php, as reachable through index.php. NOTE: the issue involving vectors 1 through 3 reportedly exists because of an incomplete fix for CVE-2008-3194.
Published: 2008-08-27T23:00:00.000Z
Updated: 2024-08-07T09:53:00.388Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-3574 |
vulnerable | 2026-06-08 04:50:35.384317 |
Details available
Multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lang_footer parameter to (a) data/inc/footer.php; the (2) pluck_version, (3) lang_install22, (4) titelkop, (5) lang_kop1, (6) lang_kop2, (7) lang_modules, (8) lang_kop4, (9) lang_kop15, (10) lang_kop5, and (11) titelkop parameters to (b) data/inc/header.php; the pluck_version and titelkop parameters to (c) data/inc/header2.php; and the (14) lang_theme6 parameter to (d) data/inc/themeinstall.php.
Published: 2008-08-10T20:00:00.000Z
Updated: 2024-08-07T09:45:18.843Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.