CVE-2022-26965

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Mar 18, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-269665.5An issue was discovered in the Linux kernel before 5.16.12. drivers/net/usb/sr9700.c allows attackers to obtain sensitive information from hCVE-2022-269677.8GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode. It can be triggered via MP4Box.CVE-2022-269699.8In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true.CVE-2022-26977.5A vulnerability was found in SourceCodester Simple E-Learning System. It has been classified as critical. Affected is an unknown function ofCVE-2022-269715.3Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. CVE-2022-269726.1Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /cgi-bin endpoint. The URL CVE-2022-269735.3Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. CVE-2022-269746.1Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a file upload mechanism. Lack of CVE-2022-269757.5Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing log files without authentication.CVE-2022-269765.4Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. CVE-2022-269776.1Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a license file upload mechanism. CVE-2022-269786.1Barco Control Room Management Suite web application, which is part of TransForm N before 3.14, is exposing a URL /checklogin.jsp endpoint. T