https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 18:14:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349590 EUVD-2026-349590 https://cve.radiocsirt.org/vuln/euvd-2026-349590 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54416 <p>Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php (&#39;.php&#39;,&#39;php3&#39;,&#39;php4&#39;,&#39;php5&#39;,&#39;php6&#39;,&#39;php7&#39;,&#39;phtml&#39;,&#39;.phtm&#39;,&#39;.pht&#39;,&#39;.ph3&#39;,&#39;.ph4&#39;,&#39;.ph5&#39;,&#39;.asp&#39;,&#39;.cgi&#39;,&#39;.phar&#39;), checked against the last 4-5 characters of the filename.</p> <p>Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php (&#39;.php&#39;,&#39;php3&#39;,&#39;php4&#39;,&#39;php5&#39;,&#39;php6&#39;,&#39;php7&#39;,&#39;phtml&#39;,&#39;.phtm&#39;,&#39;.pht&#39;,&#39;.ph3&#39;,&#39;.ph4&#39;,&#39;.ph5&#39;,&#39;.asp&#39;,&#39;.cgi&#39;,&#39;.phar&#39;), checked against the last 4-5 characters of the filename.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54416 https://cve.radiocsirt.org/vuln/ghsa-fvwx-9qcr-crph <p>Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php (&#39;.php&#39;,&#39;php3&#39;,&#39;php4&#39;,&#39;php5&#39;,&#39;php6&#39;,&#39;php7&#39;,&#39;phtml&#39;,&#39;.phtm&#39;,&#39;.pht&#39;,&#39;.ph3&#39;,&#39;.ph4&#39;,&#39;.ph5&#39;,&#39;.asp&#39;,&#39;.cgi&#39;,&#39;.phar&#39;), checked against the last 4-5 characters of the filename. The blacklist omits the &#39;.php8&#39; extension. An authenticated administrator can upload a file named e.g. shell.php8, which is stored unmodified and, on servers running PHP 8.x, is executed as PHP by the web server, resulting in remote code execution.</p> <p>Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php (&#39;.php&#39;,&#39;php3&#39;,&#39;php4&#39;,&#39;php5&#39;,&#39;php6&#39;,&#39;php7&#39;,&#39;phtml&#39;,&#39;.phtm&#39;,&#39;.pht&#39;,&#39;.ph3&#39;,&#39;.ph4&#39;,&#39;.ph5&#39;,&#39;.asp&#39;,&#39;.cgi&#39;,&#39;.phar&#39;), checked against the last 4-5 characters of the filename. The blacklist omits the &#39;.php8&#39; extension. An authenticated administrator can upload a file named e.g. shell.php8, which is stored unmodified and, on servers running PHP 8.x, is executed as PHP by the web server, resulting in remote code execution.</p> https://cve.radiocsirt.org/vuln/ghsa-fvwx-9qcr-crph