A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.
CVSS Score
4.7
EPSS Score
0.001
Published
2026-01-02
Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.
CVSS Score
7.5
EPSS Score
0.205
Published
2012-08-26
PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.
CVSS Score
5.0
EPSS Score
0.003
Published
2012-08-26
Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update.
CVSS Score
4.3
EPSS Score
0.003
Published
2012-08-26
Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score
4.3
EPSS Score
0.039
Published
2007-07-03
Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code via a .jpg filename.
CVSS Score
7.5
EPSS Score
0.081
Published
2007-06-27