Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-8v28-3j53-xvq8

Опубликовано: 02 янв. 2026
Источник: github
Github: Не прошло ревью
CVSS4: 2
CVSS3: 4.7

Описание

A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.

A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.

EPSS

Процентиль: 16%
0.0005
Низкий

2 Low

CVSS4

4.7 Medium

CVSS3

Дефекты

CWE-20

Связанные уязвимости

CVSS3: 4.7
ubuntu
около 1 месяца назад

A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.

CVSS3: 4.7
nvd
около 1 месяца назад

A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.

CVSS3: 4.7
debian
около 1 месяца назад

A vulnerability was determined in PluXml up to 5.8.22. Affected is the ...

EPSS

Процентиль: 16%
0.0005
Низкий

2 Low

CVSS4

4.7 Medium

CVSS3

Дефекты

CWE-20