CVE-2019-1010062

CRITICAL 9.8CVE-2019-1010062 · Published 16/07/2019 · updated 17/06/2026

In short

CVE-2019-1010062 is a CRITICAL (CVSS 9.8) vulnerability affecting pluckcms (pluck-cms).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
pluckcms pluck-cms	`≤ 4.7.4`	No fix yet

Description

PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.

References

pluck-cms/pluck commit 09f0ab8 · Patch
pluck-cms/pluck · Third Party Advisory

More vulnerabilities in pluckcms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free