Pluxml Vulnerabilities

This vulnerability allows an attacker to take control of a victim's session by setting a fixed session ID before the victim logs in, which can lead to session hijacking. The attacker needs to know or guess the session ID, and it has been confirmed in specific versions of the PluXml CMS, but other versions may also be at risk.

An attacker with editing privileges on a PluXml CMS website can inject malicious HTML and JavaScript into static pages, which will run whenever someone visits those pages. This means they could steal user data or perform actions on behalf of visitors without their consent.

This vulnerability allows an attacker to upload a malicious SVG file to a PluXml CMS site, which can then execute harmful code when a victim directly accesses the file. The attacker needs to be authenticated to upload the file, and while the link to the image may not trigger the attack, accessing the file directly will still run the malicious code.