CVE-2024-22636

PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt	Exploit
https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:pluxml:pluxml:5.8.9:*:*:*:*:*:*:*

History

21 Nov 2024, 08:56

Type	Values Removed	Values Added
References	~~() https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt - Exploit~~	() https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt - Exploit

29 Jan 2024, 15:57

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
References	~~() https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt -~~	() https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt - Exploit
CPE		cpe:2.3:a:pluxml:pluxml:5.8.9:::::::*

25 Jan 2024, 21:52

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-25 21:15

Updated : 2025-05-30 15:15

NVD link : CVE-2024-22636

Mitre link : CVE-2024-22636

CVE.ORG link : CVE-2024-22636

JSON object : View

Products Affected

pluxml

pluxml

CWE

NVD-CWE-noinfo

{"id": "CVE-2024-22636", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2024-01-25T21:15:09.380", "references": [{"url": "https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://github.com/capture0x/PluXml-RCE/blob/main/PluXml.txt", "tags": ["Exploit"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field."}, {"lang": "es", "value": "Se descubri\u00f3 que PluXml Blog v5.8.9 contiene una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo (RCE) en la funci\u00f3n Static Pages. Esta vulnerabilidad se explota inyectando un payload dise\u00f1ado en el campo Content."}], "lastModified": "2025-05-30T15:15:32.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pluxml:pluxml:5.8.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFFDBCD0-B737-4DE5-ABB5-171D353354B6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}