CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 27/02/2026 |
| CVE-2026-24351 | 보통5.4 | PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnera | 27/02/2026 |
| CVE-2026-24350 | 보통5.4 | PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malicious payload, which will be executed when a victim clicks the link associated with the uploaded image.
In version 5.9.0-rc7 clicking the link associated with the uploaded image does | 27/02/2026 |
| CVE-2025-15438 | 높음7.2 | A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publi | 02/01/2026 |
| CVE-2025-67436 | 보통6.5 | Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php). | 22/12/2025 |
| CVE-2024-22636 | 높음8.8 | PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field. | 25/01/2024 |
| CVE-2022-25020 | 보통5.4 | A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post. | 01/03/2022 |
| CVE-2022-25018 | 높음8.8 | Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages. | 01/03/2022 |
| CVE-2022-24587 | 보통5.4 | A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML. | 15/02/2022 |
| CVE-2022-24585 | 보통5.4 | A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter. | 15/02/2022 |
| CVE-2022-24586 | 보통5.4 | A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters. | 15/02/2022 |
| CVE-2021-38603 | 보통4.8 | PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field. | 12/08/2021 |
| CVE-2021-38602 | 보통4.8 | PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content. | 12/08/2021 |
| CVE-2020-18185 | 심각9.8 | class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment. | 02/10/2020 |
| CVE-2017-1001001 | 보통5.4 | PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges. | 01/11/2017 |
| CVE-2012-4675 | 보통4.3 | Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update. | 26/08/2012 |
| CVE-2012-4674 | 보통5.0 | PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID. | 26/08/2012 |
| CVE-2012-2227 | 높음7.5 | Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter. | 26/08/2012 |