CVE-2025-67436
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).
Risk Assessment
An administrator or an attacker with a compromised admin account could gain full control over the web server. This may lead to data theft, content modification, and further lateral movement.
Recommendation
Update PluXml to a version containing the fix and restrict permissions to edit theme files. Implement file integrity monitoring and strong authentication for administrative accounts.
Other vulnerabilities in PluXml CMS
See all- CVE-2026-24352Critical
PluXml CMS allows a user's session identifier to be set before authentication, enabling an attacker to hijack the session after authentication. The session ID remains unchanged after authentication, creating a risk of session takeover.
- CVE-2025-57567Critical
A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file under the default theme directory. An authenticated administrator can overwrite this file with arbitrary PHP code via the admin panel.
Original NVD description (English source)
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS