CVE-2025-67436

Medium · 6.5

CVSS

6.5

EPSS

0.6%

Published

Dec 22, 2025

CISA due date

—

The record

Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php).

Affected packages

Ecosystem	Package	Introduced	Fixed