Vulnerability Database

319,897

Total vulnerabilities in the database

CVE-2019-11344

data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file, because only certain PHP-related filename extensions are blocked.

  • Published: Apr 19, 2019
  • Updated: Nov 9, 2025
  • CVE: CVE-2019-11344
  • Severity: High
  • Exploit:

CVSS v2:

  • Severity: High
  • Score: 7.5
  • AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
pluck-cms / pluck 4.7.8 4.7.8.x