CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-7197
https://notcve.org/view.php?id=CVE-2018-7197
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL. Se ha descubierto un problema hasta la versión 4.7.4 de Pluck. Una vulnerabilidad de Cross-Site Scripting (XSS) persistente permite que usuarios remotos no autenticados inyecten scripts web o HTML arbitrarios en comentarios de reacción en admin/blog mediante una URL manipulada. • https://github.com/Alyssa-o-Herrera/CVE-2018-7197 https://github.com/pluck-cms/pluck/issues/47 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2014-8706
https://notcve.org/view.php?id=CVE-2014-8706
Pluck CMS 4.7.2 allows remote attackers to obtain sensitive information by (1) changing "PHPSESSID" to an array; (2) adding non-alphanumeric chars to "PHPSESSID"; (3) changing the image parameter to an array; or (4) changing the image parameter to a string, which reveals the installation path in an error message. Pluck CMS 4.7.2 permite a atacantes remotos obtener información sensible al (1) cambiar "PHPSESSID" a un array; (2) añadir caracteres alfanuméricos a "PHPSESSID"; (3) cambiar el parámetro image a un array; o (4) cambiar el parámetro image a una cadena, lo que revela la ruta de instalación en un mensaje de error. • http://rossmarks.uk/portfolio.php http://rossmarks.uk/whitepapers/pluck_cms_4.7.txt • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2014-8707
https://notcve.org/view.php?id=CVE-2014-8707
Cross-site scripting (XSS) vulnerability in TinyMCE in Pluck CMS 4.7.2 allows remote authenticated users to inject arbitrary web script or HTML via the "edit HTML source" option. Vulnerabilidad de XSS en TinyMCE en Pluck CMS 4.7.2 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios mediante la opción "editar fuente HTML". • http://rossmarks.uk/portfolio.php http://rossmarks.uk/whitepapers/pluck_cms_4.7.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2014-8708
https://notcve.org/view.php?id=CVE-2014-8708
Pluck CMS 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature. Pluck CMS 4.7.2 permite a atacantes remotos ejecutar código arbitrario a través de la funcionalidad del formulario del blog. • http://rossmarks.uk/portfolio.php http://rossmarks.uk/whitepapers/pluck_cms_4.7.txt • CWE-264: Permissions, Privileges, and Access Controls •