Pluck-cms Pluck 4.7.16 Dev4
Approved changes feed: RSS · Atom
cpe:2.3:a:pluck-cms:pluck:4.7.16:dev4:*:*:*:*:*:*part: a version: 4.7.16 update: dev4
| Vendor | Pluck Cms (79818d9e-3bb6-5d0c-b0a3-8aaffb20024d) |
|---|---|
| Product | Pluck (4e081014-454c-55c8-a654-77e6221e09f3) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pluck-cms/pluck |
purl2cpe | 2026-06-01 10:15:56.527460 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-27083 |
vulnerable | 2026-06-08 05:57:40.613506 |
Details available
An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality.
Published: 2023-06-22T00:00:00.000Z
Updated: 2024-12-06T21:21:15.876Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-27082 |
vulnerable | 2026-06-08 05:57:40.611329 |
Details available
Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code via upload of crafted html file.
Published: 2023-06-26T00:00:00.000Z
Updated: 2024-12-04T17:08:13.739Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-25828 |
vulnerable | 2026-06-08 05:56:10.685660 |
Authenticate Remote Code Execution in Pluck CMS
Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a normalization process before being available on the site. Due to lack of file extension validation, it is possible to upload a crafted JPEG payload containing an embedded PHP web-shell. An attacker may navigate to it directly to achieve RCE on the underlying web server. Administrator credentials for the Pluck CMS web interface are required to access the albums module feature, and are thus required to exploit this vulnerability. CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C (8.2 High)
Published: 2023-03-27T16:35:22.406Z
Updated: 2025-02-19T17:00:50.974Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.