CVE-2024-48138: Pluxml

Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days.

A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template.

Affected products

• Pluxml Pluxml: before 5.8.16 (fixed in 5.8.16)

Published 2024-10-29. Last modified 2026-06-17.