PT-2026-1068 · Pluxml · Pluxml

V3Ged4G · Publicado 2026-01-02 · Atualizado 2026-02-27 · CVE-2025-15438

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PluXml versions prior to 5.8.23

Description A flaw exists in PluXml that could allow for remote code execution. The issue is located in the FileCookieJar:: destruct function within the core/admin/medias.php file of the Media Management Module. Manipulation of the File argument can lead to deserialization. The exploit has been publicly disclosed.

Recommendations Update to PluXml version 5.8.23 or later.

Exploit

Correção

Deserialization of Untrusted Data

RCE

Enumeração de Fraquezas

CWE-502

CWE-20

Identificadores relacionados

CVE-2025-15438

Produtos afetados

Pluxml

Referências · 12

• 🔥 https://note-hxlab.wetolink.com/share/9SJUnaDcJuqz · Exploit
• https://cve.org/CVERecord?id=CVE-2025-15438 · Nota de Segurança
• https://t.me/CVEtracker/41231 · Publicação no Telegram
• https://t.me/cveNotify/153413 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2025-15438 · Aviso do Fabricante
• https://vuldb.com/?id.339383 · Nota
• https://twitter.com/CVEnew/status/2007103445967257820 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-15438 · Nota de Segurança
• https://vuldb.com/?submit.713989 · Nota
• https://osv.dev/vulnerability/CVE-2025-15438 · Aviso do Fabricante
• https://vuldb.com/?ctiid.339383 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-15438 · Aviso do Fabricante