Plume-cms
Plume-cms Plume CMS: vulnerabilities and CVEs
Plume-cms Plume CMS has 10 published vulnerabilities, 0 of them in the last 12 months. 0 are rated critical and 0 are listed by CISA as actively exploited.
CVEs10
Last 12 months0
Critical0
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2012-1414 | Medium (6.8) | 0.95% | — | Oct 7, 2012 | Cross-site request forgery (CSRF) vulnerability in manager/news.php in Plume CMS 1.2.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that create News pages via a publish… |
| CVE-2012-2156 | Medium (4.3) | 3.8% | — | Apr 11, 2012 | Multiple cross-site scripting (XSS) vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the u_email parameter (aka Authors Email field) to… |
| CVE-2011-3985 | Low (2.6) | 1.2% | — | Nov 9, 2011 | Cross-site scripting (XSS) vulnerability in Plume before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2009-3418 | Medium (6.5) | 0.80% | — | Sep 25, 2009 | Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow (1) remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and (2) remote authenticated administrators to… |
| CVE-2008-1048 | Medium (4.3) | 1.1% | — | Feb 27, 2008 | Cross-site scripting (XSS) vulnerability in manager/xmedia.php in Plume CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the dir parameter. |
| CVE-2006-7021 | High (7.5) | 2.6% | — | Feb 15, 2007 | PHP remote file inclusion vulnerability in manager/tools/link/dbinstall.php in Plume CMS 1.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter. |
| CVE-2006-4533 | High (7.5) | 4.3% | — | Sep 1, 2006 | Multiple PHP remote file inclusion vulnerabilities in Plume CMS 1.0.6 and earlier allow remote attackers to execute arbitrary PHP code via the _PX_config[manager_path] parameter to (1) articles.php, (2) categories.php,… |
| CVE-2006-3562 | High (7.5) | 3.1% | — | Jul 13, 2006 | PHP remote file inclusion vulnerabilities in plume cms 1.0.4 allow remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter to (1) index.php, (2) rss.php, or (3) search.php, a… |
| CVE-2006-2645 | High (7.5) | 5.6% | — | May 30, 2006 | PHP remote file inclusion vulnerability in manager/frontinc/prepend.php for Plume 1.0.3 allows remote attackers to execute arbitrary code via a URL in the _PX_config[manager_path] parameter. NOTE: this is a different… |
| CVE-2006-0725 | Medium (6.8) | 2.9% | — | Feb 16, 2006 | PHP remote file inclusion vulnerability in prepend.php in Plume CMS 1.0.2, when register_globals is enabled, allows remote attackers to include arbitrary files via a URL in the _PX_config[manager_path] parameter. NOTE:… |