PT-2011-4797

Name of the Vulnerable Software and Affected Versions Plume versions prior to 1.2.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions prior to 1.2.3, update to version 1.2.3 or later to resolve the issue...

CVE-2011-3985: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Plume before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Plume vulnerable to cross-site scripting

Overview Plume contains a cross-site scripting vulnerability. Plume is a Content Management System CMS. Plume contains a cross-site scripting vulnerability. Daiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Informati...

JVN#08307791: Plume vulnerable to cross-site scripting

Plume is a Content Management System CMS. Plume contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the web browser of a user that is logged in as administrator. Solution Update the Software Update to the latest version according to the information provide...

CVE-2010-2294

Cross-site request forgery CSRF vulnerability in Plume CMS 1.2.4 and possibly earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Plume CMS 1.2.4 and possibly earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors...

CVE-2010-2294

Cross-site request forgery CSRF vulnerability in Plume CMS 1.2.4 and possibly earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors...

CVE-2010-2294

CVE-2010-2294 affects Plume CMS 1.2.4 (and possibly earlier). The vulnerability is a Cross-Site Request Forgery that allows an attacker to hijack the administrator’s session and perform password-change requests, enabling unauthorized admin credential changes via unspecified vectors. The connected...

CVE-2010-2294: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Plume CMS 1.2.4 and possibly earlier allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via unspecified vectors...

[MajorSecurity SA-070]Plume CMS - change Admin Password via Cross-site Request Forgery

MajorSecurity SA-070Plume CMS - change Admin Password via Cross-site Request Forgery Details ======= Product: Plume CMS Security-Risk: high Remote-Exploit: yes Vendor-URL: http://www.plume-cms.net/ Advisory-Status: published Credits ============ Discovered by: David Vieira-Kurz...

Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities

No description provided by source. Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities +Title: Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities +Version: 1.2.4 other or lower version may be also affected +Download: http://sourceforge.net/projects/pxsystem/files/ +Author:...

Plume CMS 1.2.4 Local File Inclusion

Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities +Title: Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities +Version: 1.2.4 other or lower version may be also affected +Download: http://sourceforge.net/projects/pxsystem/files/ +Author: eidelweiss +Contact:...

Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities

Exploit for php platform in category web applications ============================================================= Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities ============================================================= Plume CMS 1.2.4 Multiple Local File Inclusion...

Plume CMS 1.2.4 - Multiple Local File Inclusions

Plume CMS 1.2.4 - Multiple Local File Inclusions Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities +Title: Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities +Version: 1.2.4 other or lower version may be also affected +Download: http://sourceforge.net/projects/pxsystem/file...

Plume CMS 1.2.4 - Multiple Local File Inclusions

Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities +Title: Plume CMS 1.2.4 Multiple Local File Inclusion Vulnerabilities +Version: 1.2.4 other or lower version may be also affected +Download: http://sourceforge.net/projects/pxsystem/files/ +Author: eidelweiss +Contact:...

CVE-2009-3418

Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow 1 remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an editlink action to...

Sql injection

Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow 1 remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an editlink action to...

CVE-2009-3418

Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow 1 remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an editlink action to...

CVE-2009-3418

CVE-2009-3418 affects Plume CMS 1.2.3 with two SQL injection paths: remote authenticated users via the m parameter in manager/index.php, and remote authenticated administrators via the id parameter in an edit_link action to manager/tools.php. No exploits are detailed in the provided documents; th...

PT-2009-5712 · Plume · Plume Cms

Name of the Vulnerable Software and Affected Versions: Plume CMS version 1.2.3 Description: The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via the "m" parameter to "manager/index.php" or by remote authenticated administrators via the "id"...