CVE-2018-11736

EPSS 8.6%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Popular PoC on GitHub (1 stars) — exploitation code widely available.

CVSS —EPSS 8.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

05 Jun 2018Published on NVD

08 Dec 2025Public PoC

Weaponization speed

2743 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

An issue was discovered in Pluck before 4.7.7-dev2. /data/inc/images.php allows remote attackers to upload and execute arbitrary PHP code by using the image/jpeg content type for a .htaccess file.

Affected products

n/a · n/a

public PoCs found — 2

githubgithub.com/purgemebaby/CVE-2018-11736★ 1 exploitdbwww.exploit-db.com/exploits/52460unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://github.com/pluck-cms/pluck/issues/61 https://github.com/pluck-cms/pluck/releases/tag/4.7.7-dev2