Skip to content
Noroxi

PluXml records

23 published records for vendor pluxml.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 20
  3. 21
  4. 22
  5. 24
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

23 records
  • CVE-2020-18185
    40Plan

    class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment.

    CriticalCVSS 9.8No exploitEPSS 1%

    pluxml · pluxmlOct 2, 2020

  • CVE-2024-48138
    39Monitor

    A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows at

    CriticalCVSS 9.8No exploitEPSS 0%

    Oct 29, 2024

  • CVE-2022-25018
    36Monitor

    Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.

    HighCVSS 8.8Proof of conceptEPSS 2%

    pluxml · pluxmlFeb 28, 2022

  • CVE-2024-22636
    35Monitor

    PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature.

    HighCVSS 8.8No exploitEPSS 1%

    pluxml · pluxmlJan 25, 2024

  • CVE-2012-2227
    33Monitor

    Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local

    HighCVSS 7.5Proof of conceptEPSS 9%

    pluxml · pluxmlAug 26, 2012

  • CVE-2007-3432
    32Monitor

    Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code

    HighCVSS 7.5Proof of conceptEPSS 8%

    pluxml · pluxmlJun 26, 2007

  • CVE-2025-67436
    26Monitor

    Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP

    MediumCVSS 6.5No exploitEPSS 0%

    pluxml · pluxmlDec 22, 2025

  • CVE-2025-70128
    24Monitor

    A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier.

    MediumCVSS 6.1No exploitEPSS 0%

    pluxml · pluxmlMar 10, 2026

  • CVE-2022-25020
    21Monitor

    A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload

    MediumCVSS 5.4Proof of conceptEPSS 1%

    pluxml · pluxmlFeb 28, 2022

  • CVE-2022-24585
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbi

    MediumCVSS 5.4No exploitEPSS 0%

    pluxml · pluxmlFeb 15, 2022

  • CVE-2022-24587
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitr

    MediumCVSS 5.4No exploitEPSS 0%

    pluxml · pluxmlFeb 15, 2022

  • CVE-2022-24586
    21Monitor

    A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute a

    MediumCVSS 5.4No exploitEPSS 0%

    pluxml · pluxmlFeb 15, 2022

  • CVE-2017-1001001
    21Monitor

    PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalat

    MediumCVSS 5.4No exploitEPSS 0%

    pluxml · pluxmlNov 1, 2017

  • CVE-2025-70129
    21Monitor

    If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that

    MediumCVSS 5.3No exploitEPSS 0%

    pluxml · pluxmlMar 10, 2026

  • CVE-2012-4674
    20Monitor

    PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.

    MediumCVSS 5.0No exploitEPSS 1%

    pluxml · pluxmlAug 26, 2012

  • CVE-2026-24351
    20Monitor

    Stored XSS in PluXml CMS

    MediumCVSS 5.1No exploitEPSS 0%

    pluxml · pluxmlFeb 27, 2026

  • CVE-2026-24350
    20Monitor

    Stored XSS in PluXml CMS

    MediumCVSS 5.1No exploitEPSS 0%

    pluxml · pluxmlFeb 27, 2026

  • CVE-2021-38603
    19Monitor

    PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.

    MediumCVSS 4.8Proof of conceptEPSS 1%

    pluxml · pluxmlAug 12, 2021

  • CVE-2021-38602
    19Monitor

    PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.

    MediumCVSS 4.8Proof of conceptEPSS 0%

    pluxml · pluxmlAug 12, 2021

  • CVE-2026-24352
    19Monitor

    Session Fixation in PluXml CMS

    MediumCVSS 4.8No exploitEPSS 0%

    pluxml · pluxmlFeb 27, 2026

  • CVE-2007-3542
    18Monitor

    Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML vi

    MediumCVSS 4.3Proof of conceptEPSS 1%

    pluxml · pluxmlJul 3, 2007

  • CVE-2012-4675
    17Monitor

    Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vect

    MediumCVSS 4.3No exploitEPSS 1%

    pluxml · pluxmlAug 26, 2012

  • CVE-2025-15438
    8Monitor

    PluXml Media Management medias.php __destruct deserialization

    LowCVSS 2.0No exploitEPSS 0%

    pluxml · pluxmlJan 2, 2026