CVE-2018-11331

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-11331

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11331.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-11331

Published

2018-05-21T21:29:00.330Z

Modified

2026-07-08T14:13:45.352683Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An issue was discovered in Pluck before 4.7.6. Remote PHP code execution is possible because the set of disallowed filetypes for uploads in missing some applicable ones such as .phtml and .htaccess.

References

Affected packages

Git / github.com/pluck-cms/pluck

Affected ranges

Type

GIT

Repo

https://github.com/pluck-cms/pluck

Events

Introduced

Fixed

8d86b4b0b2447de9be276cce889676f8b3c81061

Fixed

8f6541e60c9435e82e9c531a20cb3c218d36976e

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.7.6"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:pluck-cms:pluck:*:*:*:*:*:*:*:*"
}

Affected versions

4.*

4.7

4.7.2

4.7.3

4.7.5

4.7.5-noversion

4.74

4.74-dev5

4.743

v4.*

v4.7.4

v4.744

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-11331.json"