CVE-2012-2227: Pluxml

High severity, CVSS 7.5. EPSS: 9.8% chance of exploitation in the next 30 days.

Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter.

Affected products

• Pluxml Pluxml: up to and including 5.1.5

Published 2012-08-26. Last modified 2026-06-16.