Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (19 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-15438 1 Pluxml 1 Pluxml 2026-01-05 4.7 Medium
A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.
CVE-2025-67436 1 Pluxml 1 Pluxml 2026-01-02 6.5 Medium
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).
CVE-2025-57567 1 Pluxml 1 Pluxml 2025-10-21 9.1 Critical
A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file located under the default theme directory (/themes/defaut/css/minify.php). An authenticated administrator user can overwrite this file with arbitrary PHP code via the admin panel, enabling execution of system commands.
CVE-2024-22636 1 Pluxml 1 Pluxml 2025-05-30 8.8 High
PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field.
CVE-2017-1001001 1 Pluxml 1 Pluxml 2025-04-20 N/A
PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges.
CVE-2012-2227 1 Pluxml 1 Pluxml 2025-04-11 N/A
Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.
CVE-2012-4674 1 Pluxml 1 Pluxml 2025-04-11 N/A
PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.
CVE-2012-4675 1 Pluxml 1 Pluxml 2025-04-11 N/A
Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update.
CVE-2007-3432 1 Pluxml 1 Pluxml 2025-04-09 N/A
Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code via a .jpg filename.
CVE-2007-3542 1 Pluxml 1 Pluxml 2025-04-09 N/A
Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVE-2022-25020 1 Pluxml 1 Pluxml 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
CVE-2022-25018 1 Pluxml 1 Pluxml 2024-11-21 8.8 High
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
CVE-2022-24587 1 Pluxml 1 Pluxml 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML.
CVE-2022-24586 1 Pluxml 1 Pluxml 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters.
CVE-2022-24585 1 Pluxml 1 Pluxml 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter.
CVE-2021-38603 1 Pluxml 1 Pluxml 2024-11-21 4.8 Medium
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
CVE-2021-38602 1 Pluxml 1 Pluxml 2024-11-21 4.8 Medium
PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.
CVE-2020-18185 1 Pluxml 1 Pluxml 2024-11-21 9.8 Critical
class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment.
CVE-2024-48138 1 Pluxml 1 Pluxml 2024-11-01 9.8 Critical
A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template.