TI-2026-13546 CVE-2026-16205 · GHSA-9q2q-q44g-f28v
Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting
Priority MEDIUM 55
A weakness has been identified in Pluck CMS up to 4.7.21.
Vulnerabilities
8 records
TI-2023-04615 CVE-2023-5013 · GHSA-p69j-9595-rm77
Pluck CMS Installation install.php cross site scripting
Priority MEDIUM 58
A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic.
TI-2023-11098 CVE-2023-25828 · GHSA-cp9w-xxfq-xfcf
Authenticate Remote Code Execution in Pluck CMS
Priority LOW 35
Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module.
TI-2008-03690 CVE-2008-3851 · GHSA-g567-gmj2-gq25
Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote…
Priority LOW 34
Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the (1) blogpost, (2) cat, and (3) file para…
TI-2008-03421 CVE-2008-3574 · GHSA-vh5p-g64v-2w64
Multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals…
Priority LOW 16
Multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lang_footer parameter to (a) data/inc/footer…
TI-2008-03056 CVE-2008-3194 · GHSA-qpjg-r2f6-r5rc
Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php…
Priority LOW 35
Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php in pluck 4.5.1 allow remote attackers to include and execute arbitrary local files via a ..
TI-2007-04048 CVE-2007-4181 · GHSA-c345-8824-6347
PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when…
Priority LOW 33
PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter.
TI-2007-04047 CVE-2007-4180 · GHSA-hg68-h73w-q4qq
Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when…
Priority LOW 26
Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to read arbitrary local files via a ..