HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2012-2227

CVSS 7.5v2.0pub. 2012-08-26upd. 2026-04-29

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.

CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Pluxml

    APP
    Pluxml
    ≤ 5.1.5
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2020-18185CRITICAL9.8ten sam produkt

class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration f...

CVE-2024-22636HIGH8.8ten sam produkt

PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages f...

CVE-2022-25018HIGH8.8ten sam produkt

Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into s...

CVE-2007-3432HIGH7.5ten sam produkt

Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload a...

CVE-2025-70128MEDIUM6.1ten sam produkt

A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml ver...