CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2018-16729
https://notcve.org/view.php?id=CVE-2018-16729
Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files. Pluck 4.7.7 permite Cross-Site Scripting (XSS) mediante un archivo SVG que contiene Javascript en un elemento SCRIPT y se sube mediante pages->manage en admin.php?action=files. • https://github.com/pluck-cms/pluck/issues/63 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 1CVE-2018-11736
https://notcve.org/view.php?id=CVE-2018-11736
An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file. Se ha descubierto un problema en Pluck en versiones anteriores a la 4.7.7-dev2. /data/inc/images.php permite que los atacantes remotos suban y ejecutan código PHP arbitrario utilizando el tipo de contenido image/jpeg para un archivo .htaccess. • https://github.com/pluck-cms/pluck/issues/61 https://github.com/pluck-cms/pluck/releases/tag/4.7.7-dev2 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-11331
https://notcve.org/view.php?id=CVE-2018-11331
An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess. Se ha descubierto un problema en versiones anteriores a la 4.7.6 de Pluck. Es posible la ejecución remota de código PHP debido a que el conjunto de tipos de archivo no permitidos para la subida carece de algunos tipos aplicables, como .phtml y .htaccess. • https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e https://github.com/pluck-cms/pluck/issues/58 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-11330
https://notcve.org/view.php?id=CVE-2018-11330
An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted. Se ha descubierto un problema en versiones anteriores a la 4.7.6 de Pluck. Hay Cross-Site Scripting (XSS) persistente autenticado debido a que el conjunto de caracteres para los nombres de archivo no está restringido de forma adecuada. • https://github.com/pluck-cms/pluck/commit/8f6541e60c9435e82e9c531a20cb3c218d36976e https://github.com/pluck-cms/pluck/issues/58 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2018-7197
https://notcve.org/view.php?id=CVE-2018-7197
An issue was discovered in Pluck through 4.7.4. A stored cross-site scripting (XSS) vulnerability allows remote unauthenticated users to inject arbitrary web script or HTML into admin/blog Reaction Comments via a crafted URL. Se ha descubierto un problema hasta la versión 4.7.4 de Pluck. Una vulnerabilidad de Cross-Site Scripting (XSS) persistente permite que usuarios remotos no autenticados inyecten scripts web o HTML arbitrarios en comentarios de reacción en admin/blog mediante una URL manipulada. • https://github.com/Alyssa-o-Herrera/CVE-2018-7197 https://github.com/pluck-cms/pluck/issues/47 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •