A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters.
CVSS Score
5.4
EPSS Score
0.002
Published
2022-02-15
PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.
CVSS Score
4.8
EPSS Score
0.005
Published
2021-08-12
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
CVSS Score
4.8
EPSS Score
0.008
Published
2021-08-12
class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment.
CVSS Score
9.8
EPSS Score
0.005
Published
2020-10-02
PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges.
CVSS Score
5.4
EPSS Score
0.002
Published
2017-11-01
Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.
CVSS Score
7.5
EPSS Score
0.205
Published
2012-08-26
PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.
CVSS Score
5.0
EPSS Score
0.003
Published
2012-08-26
Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update.
CVSS Score
4.3
EPSS Score
0.003
Published
2012-08-26
Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score
4.3
EPSS Score
0.039
Published
2007-07-03
Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code via a .jpg filename.
CVSS Score
7.5
EPSS Score
0.081
Published
2007-06-27