CVE-2025-15438
Last modified
CVE-2025-15438 is a low-severity vulnerability rated 2/10 on the CVSS scale. A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Pluxml | Pluxml | <= 5.8.22 |
References
- https://note-hxlab.wetolink.com/share/9SJUnaDcJuqzExploit, Third Party Advisory
- https://vuldb.com/?ctiid.339383Permissions Required, VDB Entry
- https://vuldb.com/?id.339383Third Party Advisory, VDB Entry
- https://vuldb.com/?submit.713989Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-15438?
How severe is CVE-2025-15438?
How do I fix CVE-2025-15438?
Are you affected by CVE-2025-15438?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST