Approved changes feed: RSS · Atom
cpe:2.3:a:pluck-cms:pluck_cms:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Pluck Cms (79818d9e-3bb6-5d0c-b0a3-8aaffb20024d) |
|---|---|
| Product | Pluck Cms (e5159de0-4e12-55a2-9bf6-d03266cf18b8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54416 |
vulnerable | 2026-09-16 04:33:28.215131 |
Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist
HIGH (7.2)
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.
Published: 2026-08-05T06:58:23.512Z
Updated: 2026-08-10T11:44:06.635Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-70376 |
vulnerable | 2026-09-16 04:33:00.641630 |
Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
CRITICAL (9.6)
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
Published: 2026-08-05T06:58:44.471Z
Updated: 2026-08-10T11:44:52.887Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.