Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.
CVSS Score
7.5
EPSS Score
0.205
Published
2012-08-26
PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID.
CVSS Score
5.0
EPSS Score
0.003
Published
2012-08-26
Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update.
CVSS Score
4.3
EPSS Score
0.003
Published
2012-08-26