CVE-2023-50564

An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

29.07% chance of exploitation in the next 30 days, 98th percentile

Published

2023-12-14

Updated

2024-10-08

Proof-of-concept exploits (10)

• 0xDTC/Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-505641★ · 2025-02-02
• Mrterrestrial/CVE-2023-505641★ · 2024-10-15
• Rai2en/CVE-2023-50564_Pluck-v4.7.18_PoC18★ · 2026-02-09
• TanveerS1ngh/Pluck-CMS-v4.7.18-Remote-Code-Execution-CVE-2023-505641★ · 2025-02-02
• glynzr/CVE-2023-505640★ · 2025-05-25
• ipuig/CVE-2023-505640★ · 2024-08-02
• rwexecute/CVE-2023-505640★ · 2024-10-14
• thefizzyfish/CVE-2023-50564-pluck3★ · 2024-10-03
• xpltive/CVE-2023-505641★ · 2024-12-22
• kikechans/-Pluck-CMS-RCE-CVE-2023-50564

References

• CVE Record
• NVD entry

Related

• CVE-2009-2265
• CVE-2015-1397
• CVE-2019-17240
• CVE-2022-0944
• CVE-2023-40028
• CVE-2023-41425