{"cve":"CVE-2008-3851","nvd":{"published":"2008-08-27T23:41:00.000","modified":"2026-06-16T22:56:40.140","status":"Modified","description":"Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a ..\\ (dot dot backslash) in the (1) blogpost, (2) cat, and (3) file parameters to data/inc/themes/predefined_variables.php, as reachable through index.php; and the (4) blogpost and (5) cat parameters to data/inc/blog_include_react.php, as reachable through index.php.  NOTE: the issue involving vectors 1 through 3 reportedly exists because of an incomplete fix for CVE-2008-3194.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-22"],"references":["http://secunia.com/advisories/31607","http://securityreason.com/securityalert/4195","http://www.pluck-cms.org/releasenotes.php#4.5.3","http://www.securityfocus.com/archive/1/495706/100/0/threaded","http://www.securityfocus.com/bid/30820"],"products":["pluck:pluck"],"source":"nvd","synced_at":"2026-10-19T19:52:44.811608366+00:00"},"epss":{"cve":"CVE-2008-3851","score":0.07936,"percentile":0.94733,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}