PluXml vulnerabilities
We track 3 vulnerabilities in PluXml products across 2 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on February 27, 2026.
Latest PluXml vulnerabilities
- 9.8 Critical severity
PluXml CMS: Session Fixation
PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The
- 7.2 High severity
PluXml: Deserialization of Untrusted Data
A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The
- 9.8 Critical severity
pluxml: Improper Control of Generation of Code
A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template.