PT-2012-3843

Name of the Vulnerable Software and Affected Versions Plume CMS versions 1.2.4 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the u email parameter also known as th...

CVE-2012-2156: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...