CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-7197
https://notcve.org/view.php?id=CVE-2018-7197
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL. Se ha descubierto un problema hasta la versión 4.7.4 de Pluck. Una vulnerabilidad de Cross-Site Scripting (XSS) persistente permite que usuarios remotos no autenticados inyecten scripts web o HTML arbitrarios en comentarios de reacción en admin/blog mediante una URL manipulada. • https://github.com/Alyssa-o-Herrera/CVE-2018-7197 https://github.com/pluck-cms/pluck/issues/47 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 3%CPEs: 1EXPL: 2CVE-2008-6253 – Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Local File Inclusion
https://notcve.org/view.php?id=CVE-2008-6253
Directory traversal vulnerability in data/inc/lib/pcltar.lib.php in Pluck 4.5.3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the g_pcltar_lib_dir parameter. Vulnerabilidad de salto de directorio en data/inc/lib/pcltar.lib.php in Pluck v4.5.3, cuando register_globals está activado, permite a atacantes remotos incluir y ejecutar archivos locales de su elección a través de secuencias de salto de directorio en el parámetro "g_pcltar_lib_dir". • https://www.exploit-db.com/exploits/7153 http://secunia.com/advisories/32736 http://www.pluck-cms.org/index.php?file=kop11.php http://www.securityfocus.com/archive/1/498438 http://www.securityfocus.com/bid/32342 https://exchange.xforce.ibmcloud.com/vulnerabilities/46676 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •