CVE-2021-38602

PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.

• CWE-79

• https://github.com/KielVaughn/CVE-2021-38602Exploit, Third Party Advisory
• https://pluxml.org/download/changelog.txtRelease Notes, Vendor Advisory
• https://github.com/KielVaughn/CVE-2021-38602Exploit, Third Party Advisory
• https://pluxml.org/download/changelog.txtRelease Notes, Vendor Advisory

Published

Aug 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38592Wasm3 0.5.0 has a heap-based buffer overflow in op_Const64 (…7.5
• CVE-2021-38593Qt 5.x before 5.15.6 and 6.x through 6.1.2 has an out-of-bou…7.5
• CVE-2021-38597wolfSSL before 4.8.1 incorrectly skips OCSP verification in …5.9
• CVE-2021-38598OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.…9.1
• CVE-2021-38599WAL-G before 1.1, when a non-libsodium build (e.g., one of t…7.5
• CVE-2021-3860JFrog Artifactory before 7.25.4 (Enterprise+ deployments onl…8.8
• CVE-2021-38603PluXML 5.8.7 allows core/admin/profil.php stored XSS via the…4.8
• CVE-2021-38604In librt in the GNU C Library (aka glibc) through 2.34, sysd…7.5
• CVE-2021-38606reNgine through 0.5 relies on a predictable directory name.9.8
• CVE-2021-38607Crocoblock JetEngine before 2.6.1 allows XSS by remote authe…5.4
• CVE-2021-38608Incorrect Access Control in Tranquil WAPT Enterprise - befor…7.8
• CVE-2021-3861The RNDIS USB device class includes a buffer overflow vulner…6.8