PluXml CMS allows a user's session identifier to be set before authentication.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 27, 2026 · NIST NVD

   Detected

   PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only

2. Jun 17, 2026 · NIST NVD

   Updated

   PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only

Affected

• cpe pluxml/pluxml5.8.21
• cpe pluxml/pluxml5.9.0

Sources

• NIST NVDVulnerability recordCVE-2026-24352

  PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notifie

  nvd.nist.gov

References

• Broken Link · cert.pl
• Product · pluxml.org