CVE-2022-25018
HighCVSS 8.8Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
Pluxml version 5.8.7 was found to allow attackers to execute arbitrary code by injecting crafted PHP code into static pages.
Risk Assessment
An attacker can take over the server, steal data, or install malware, posing a serious threat to system integrity and confidentiality.
Recommendation
Immediately update Pluxml to the latest available version and remove or secure static pages against code injection.
Other vulnerabilities in Pluxml
See all- CVE-2025-15438Medium
A vulnerability was found in PluXml up to 5.8.22 in the FileCookieJar::__destruct function of core/admin/medias.php in the Media Management Module. Manipulating the File argument can lead to deserialization, and the attack can be launched remotely. The exploit has been publicly disclosed and the vendor announced a fix in version 5.8.23.
- CVE-2022-25020Medium
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
Original NVD description (English source)
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS