CVE-2022-25018
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code...
CVE-2022-25018 is a high vulnerability (CVSS 8.8) in Pluxml, published March 1, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.71%, the 86th percentile. No source names a fixed version.
- Severity
- 8.8 HighCVSS 3.1, NVD
- Exploit chance
- 2.71%EPSS, 86th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pluxmlUbuntu:16.04:LTS | All versions, plus listed versions 5.4-15.4-1ubuntu1 | None known |
pluxmlUbuntu:18.04:LTS | All versions, plus listed versions 5.5-2 | None known |
pluxmlUbuntu:20.04:LTS | All versions, plus listed versions 5.6-1 | None known |
pluxmlUbuntu:22.04:LTS | All versions, plus listed versions 5.6-1 | None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | MoritzHuppert/CVE-2022-25018 | 2022-02-25 |
What each source reports
NVD Score used
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- Record
CVE-2022-25018- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE ListNo score
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- Record
CVE-2022-25018- Updated
- 2026-11-02
EUVDEUVD-2022-29764No score
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- Record
EUVD-2022-29764- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mc3j-r9qr-6vgv
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code...
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- Record
GHSA-mc3j-r9qr-6vgv- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-25018
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- Record
UBUNTU-CVE-2022-25018- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVNo score
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
- Record
CVE-2022-25018- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/pluxml/PluXml
youtu.be/Gbe2UNCB0tY
nvd.nist.gov/vuln/detail/CVE-2022-25018
pluxml.com
ubuntu.com/security/CVE-2022-25018
cve.org/CVERecord?id=CVE-2022-25018