CVE-2026-24352
Session Fixation in PluXml CMS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
| CWE | CWE-384 |
| Vendor | pluxml |
| Product | pluxml cms |
| Published | Feb 27, 2026 |
| Last Updated | Feb 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for pluxml pluxml cms
Be the first to know when new unknown vulnerabilities affecting pluxml pluxml cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
PluXml / PluXml CMS
5.9.0-rc7 5.8.21
References
Credits
Arkadiusz Marta