PluXml CMS vulnerabilities

PluXml CMS allows a user's session identifier to be set before authentication, enabling an attacker to hijack the session after authentication. The session ID remains unchanged after authentication, creating a risk of session takeover.

A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file under the default theme directory. An authenticated administrator can overwrite this file with arbitrary PHP code via the admin panel.

Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).