CVE-2019-11344

2019-04-1919:29:00

Google

osv.dev

8 High

AI Score

Confidence

High

0.016 Low

EPSS

Percentile

87.5%

JSON

data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked.

CPENameOperatorVersion
pluckeq4.74
pluckeq4.7.8
pluckeq4.74-dev5
pluckeq4.7.3
pluckeq4.7
pluckeq4.7.7
pluckeq4.7.4
pluckeq4.7.5
pluckeq4.7.6
pluckeq4.7.2