Vulnerabilities

TI-2012-01236 CVE-2012-1414 · GHSA-5vx7-3cmr-jg43

Cross-site request forgery (CSRF) vulnerability in manager/news.php in Plume CMS 1.2.4…

LOW 32

Cross-site request forgery (CSRF) vulnerability in manager/news.php in Plume CMS 1.2.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that create News pages via a publish…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00953 Published 2012-10-07 No fix listed CWE-352

TI-2012-01929 CVE-2012-2156 · GHSA-9v4j-g8j9-mmgr

Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow…

LOW 27

Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u_email parameter (aka Authors Email field) to manager/users.ph…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03767 Published 2012-04-11 No fix listed CWE-79

TI-2011-03525 CVE-2011-3985 · GHSA-rw6r-6rrj-6j5h

Cross-site scripting (XSS) vulnerability in Plume before 1.2.3 allows remote attackers to…

LOW 16

Cross-site scripting (XSS) vulnerability in Plume before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01212 Published 2011-11-09 No fix listed CWE-79

TI-2009-03257 CVE-2009-3418 · GHSA-x99w-r7p7-9cww

Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow (1) remote authenticated…

LOW 30

Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow (1) remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and (2) remote authenticated administrators to exe…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.00802 Published 2009-09-25 No fix listed CWE-89

TI-2008-01002 CVE-2008-1048 · GHSA-44x2-g266-gvmh

Cross-site scripting (XSS) vulnerability in manager/xmedia.php in Plume CMS 1.2.2 allows…

LOW 22

Cross-site scripting (XSS) vulnerability in manager/xmedia.php in Plume CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the dir parameter.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01107 Published 2008-02-27 No fix listed CWE-79

TI-2006-06763 CVE-2006-7021 · GHSA-hccp-vgr8-pg68

PHP remote file inclusion vulnerability in manager/tools/link/dbinstall.php in Plume CMS…

LOW 38

PHP remote file inclusion vulnerability in manager/tools/link/dbinstall.php in Plume CMS 1.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0265 Published 2007-02-15 No fix listed CWE-94

TI-2006-04379 CVE-2006-4533 · GHSA-9rrg-ppwx-5r5f

Multiple PHP remote file inclusion vulnerabilities in Plume CMS 1.0.6 and earlier allow…

MEDIUM 40

Multiple PHP remote file inclusion vulnerabilities in Plume CMS 1.0.6 and earlier allow remote attackers to execute arbitrary PHP code via the _PX_config[manager_path] parameter to (1) articles.php, (2) categories.php, (…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04332 Published 2006-09-01 No fix listed CWE-94

TI-2006-03454 CVE-2006-3562 · GHSA-vr4r-48mr-4g42

PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to…

LOW 38

PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter to (1) index.php, (2) rss.php, or (3) search.php, a di…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03116 Published 2006-07-13 No fix listed CWE-94

TI-2006-02554 CVE-2006-2645 · GHSA-fq38-x2cv-8jx3

PHP remote file inclusion vulnerability in manager/frontinc/prepend.php for Plume 1.0.3…

MEDIUM 41

PHP remote file inclusion vulnerability in manager/frontinc/prepend.php for Plume 1.0.3 allows remote attackers to execute arbitrary code via a URL in the _PX_config[manager_path] parameter.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.05599 Published 2006-05-30 No fix listed CWE-94

TI-2006-00704 CVE-2006-0725 · GHSA-hj4m-fph4-j8r9

PHP remote file inclusion vulnerability in prepend.php in Plume CMS 1.0.2, when…

LOW 35

PHP remote file inclusion vulnerability in prepend.php in Plume CMS 1.0.2, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the _PX_config[manager_path] parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02949 Published 2006-02-16 No fix listed CWE-94

Vulnerabilities

Filters