CVE-2019-1010062 - AskarLabs CVE Database

CVE-2019-1010062

Vendor Pluck-Cms

Product PluckCMS

Weakness CWE-434 · Unrestricted file upload

Published July 16, 2019

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

PluckCMS 4.7.4 and earlier is affected by: CWE-434 Unrestricted Upload of File with Dangerous Type. The impact is: get webshell. The component is: data/inc/images.php line36. The attack vector is: modify the MIME TYPE on HTTP request to upload a php file. The fixed version is: after commit 09f0ab871bf633973cfd9fc4fe59d4a912397cf8.

Key dates

02Disclosure timeline

July 16, 2019 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-1010062 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html

Related vulnerabilities

04Related CVE

CVE-2025-7063 Remote Code Execution via Unrestricted File Upload in PAD CMS CVE-2023-30791 Plane 0.7.1 - Insecure file upload CVE-2025-64231 WordPress WordPress Contact Form 7 PDF, Google Sheet & Database plugin <= 3.0.0 - Arbitrary File Upload vulnerability CVE-2021-24960 WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVG CVE-2025-14885 SourceCodester Client Database Management System Leads Generation user_leads.php unrestricted upload