leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.", "datePublished": "2023-09-16T23:00:07Z", "dateModified": "2024-08-02T07:44:53Z", "keywords": "CVE-2023-5013, vulnerability, CVE, security, CMS, Pluck", "about": { "@type": "SoftwareApplication", "name": "CMS", "applicationCategory": "SecurityApplication", "operatingSystem": "All" } }
CVE-2023-5013 LOW

CVE-2023-5013: Pluck CMS Installation install.php cross site scripting

Vendor Pluck
Product CMS
Weakness CWE-79 · XSS
Published September 16, 2023
Last update August 2, 2024

CVSS base score

2.6/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to cross site scripting. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-239854 is the identifier assigned to this vulnerability.

Key dates

02Disclosure timeline

September 16, 2023 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE