https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T12:18:15.043749+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349612 EUVD-2026-349612 2026-10-06T12:18:15.046689+00:00 EUVD-2026-349612 https://cve.radiocsirt.org/vuln/fkie_cve-2026-70376 fkie_cve-2026-70376 2026-10-06T12:18:15.046728+00:00

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

 https://cve.radiocsirt.org/vuln/ghsa-qg2j-83g4-98r4 GHSA-qg2j-83g4-98r4 2026-10-06T12:18:15.046770+00:00

Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain() in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the function's elseif branch returns true, treating the request as same-origin. Because a cross-site attacker page can suppress the Referer header (e.g. via <meta name=referrer content=no-referrer>), it can force an authenticated administrator's browser to submit forged admin actions with no valid Referer, including creating pages with raw HTML (stored XSS via the rendered page) and installing PHP modules/themes (remote code execution).