20 results · Feed
-
Medium 6.1
A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8…
-
Medium 5.3
If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generat…
-
Medium 4.8
Session Fixation in PluXml CMS
PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. Th…
-
Medium 5.1
Stored XSS in PluXml CMS
PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this v…
-
Medium 5.1
Stored XSS in PluXml CMS
PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malicious payload, which will be executed when a victim clicks the link associated with the uploaded image. In version 5.9.0-…
-
Medium 4.7
PluXml Media Management medias.php __destruct deserialization
A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. Th…
-
Medium 6.5
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to in…
-
Critical 9.1
A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file …
-
Critical 9.8
A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.1…
-
High 8.8
PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. T…
-
Unscored —CVE-2022-25020 Public exploit
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML v…
-
Unscored —CVE-2022-25018 Public exploit
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pag…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attack…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows atta…
-
Unscored —
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows a…
-
Unscored —CVE-2021-38603 Public exploit
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
-
Unscored —CVE-2021-38602 Public exploit
PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.
-
Unscored —
class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a …
-
Unscored —
In PluxXml V5.7,the theme edit function /PluXml/core/admin/parametres_edittpl.php allows remote attackers to execute ar…
-
Unscored —
PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which …