CVE-2025-15438

Katalog CVE

CVSS 7.2 · High EPSS 0,47%

Kerentanan Improper Input Validation pada pluxml. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.

Rincian

Terbit di NVD

2 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://note-hxlab.wetolink.com/share/9SJUnaDcJuqz exploit · advisory pihak ketiga
• https://vuldb.com/?id.339383 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.713989 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.339383 permissions required · vdb entry