CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-7197
https://notcve.org/view.php?id=CVE-2018-7197
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL. Se ha descubierto un problema hasta la versión 4.7.4 de Pluck. Una vulnerabilidad de Cross-Site Scripting (XSS) persistente permite que usuarios remotos no autenticados inyecten scripts web o HTML arbitrarios en comentarios de reacción en admin/blog mediante una URL manipulada. • https://github.com/Alyssa-o-Herrera/CVE-2018-7197 https://github.com/pluck-cms/pluck/issues/47 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 2CVE-2008-6842 – Pluck CMS 4.6.1 - 'module_pages_site.php' Local File Inclusion
https://notcve.org/view.php?id=CVE-2008-6842
Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the post parameter. Vulnerabilidad de salto de directorio en data/modules/blog/module_pages_site.php en Pluck v4.6.1 permite a los atacantes remotos incluir e ejecutar arbitrariamente archivos locales a traves de ..(punto punto) el el parámetro post. • https://www.exploit-db.com/exploits/8271 http://secunia.com/advisories/34415 http://www.securityfocus.com/bid/34207 https://exchange.xforce.ibmcloud.com/vulnerabilities/49378 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •