What’s Vulnerable › Vulnerabilities

CVE-2018-11736

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-05 · updated 2026-06-17
• Weakness: CWE-434

Description

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file.

Affected products

• pluck-cms: through 4.7.7; 4.7.7-dev1

References

• https://github.com/pluck-cms/pluck/issues/61
• https://github.com/pluck-cms/pluck/releases/tag/4.7.7-dev2
• https://github.com/pluck-cms/pluck/issues/61
• https://github.com/pluck-cms/pluck/releases/tag/4.7.7-dev2

Get alerted when CVE-2018-11736 or the next vulnerability affects your stack