Veille CVE

Recherche « Pluck CMS »

4 CVE

Critique 1 Élevée 1 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Pluck CMS » ✕
  1. CVE-2026-70376 9.6 Critique

    pluck-cms Pluck CMS

    Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

  2. CVE-2026-54416 7.2 Élevée

    pluck-cms Pluck CMS

    Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5 characters of the filename.

  3. CVE-2026-16205 2.4 Faible

    Pluck CMS

    A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

  4. CVE-2026-31205 5.7 Moyenne

    Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageContent function